CVE-2025-39952

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39952", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.148Z", "datePublished": "2025-10-04T07:31:12.445Z", "dateUpdated": "2026-10-30T12:22:39.571Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:22:39.571Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: avoid buffer overflow in WID string configuration\n\nFix the following copy overflow warning identified by Smatch checker.\n\n drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame()\n error: '__memcpy()' 'cfg->s[i]->str' copy overflow (512 vs 65537)\n\nThis patch introduces size check before accessing the memory buffer.\nThe checks are base on the WID type of received data from the firmware.\nFor WID string configuration, the size limit is determined by individual\nelement size in 'struct wilc_cfg_str_vals' that is maintained in 'len' field\nof 'struct wilc_cfg_str'."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The overflow length and payload originate from the association-response management frame supplied over the air by the AP and relayed by the WILC firmware as a WID_ASSOC_RES_INFO config reply, so an attacker must be within WiFi radio range of the target (rogue/evil-twin AP or management-frame injection). Per kernel guidance, WiFi-frame-sourced bugs are Adjacent.\nAC:L - The attacker fully controls the 16-bit length field and the payload of the association response and can force association attempts repeatedly, so the overflow triggers deterministically on every connect with no race or uncontrollable precondition.\nPR:N - Association responses are unprotected frames exchanged before any WPA/802.1X credential verification, so the attacker needs no credentials on the target network and no account or privileges on the victim device.\nUI:N - A device with a saved profile auto-associates to a spoofed SSID, and an in-range attacker can inject a spoofed association response during an ordinary connection to a legitimate network, so no victim action is required.\nS:U - The corruption is confined to the kernel heap of the same system running the driver; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - The unbounded copy reads far past the received packet inside the 96 KB RX buffer into assoc_rsp, which is then exposed to userspace as association-response IEs via wilc_wlan_cfg_get_val(), and the resulting heap corruption provides further arbitrary-read primitives.\nI:H - Up to 65537 bytes of fully attacker-controlled data are written past a ~648-byte kzalloc'd object, an out-of-bounds write that corrupts adjacent slab objects and is a standard primitive for control-flow hijack and privilege escalation.\nA:H - A multi-kilobyte heap overflow reliably corrupts slab metadata and neighbouring allocations, producing kernel panics or oopses on the affected embedded/IoT device."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/microchip/wilc1000/wlan_cfg.c", "drivers/net/wireless/microchip/wilc1000/wlan_cfg.h"], "versions": [{"version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "lessThan": "5f1578a8684794318a60a022cedbffaa3dc444ce", "status": "affected", "versionType": "git"}, {"version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "lessThan": "6085291a1a5865d4ad70f0e5812d524ebd5d1711", "status": "affected", "versionType": "git"}, {"version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "lessThan": "2203ef417044b10a8563ade6a17c74183745d72e", "status": "affected", "versionType": "git"}, {"version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "lessThan": "ae50f8562306a7ea1cf3c9722f97ee244f974729", "status": "affected", "versionType": "git"}, {"version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "lessThan": "fe9e4d0c39311d0f97b024147a0d155333f388b5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/microchip/wilc1000/wlan_cfg.c", "drivers/net/wireless/microchip/wilc1000/wlan_cfg.h"], "versions": [{"version": "4.2", "status": "affected"}, {"version": "0", "lessThan": "4.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.108", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.49", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.9", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.6.108"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.12.49"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.16.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5f1578a8684794318a60a022cedbffaa3dc444ce"}, {"url": "https://git.kernel.org/stable/c/6085291a1a5865d4ad70f0e5812d524ebd5d1711"}, {"url": "https://git.kernel.org/stable/c/2203ef417044b10a8563ade6a17c74183745d72e"}, {"url": "https://git.kernel.org/stable/c/ae50f8562306a7ea1cf3c9722f97ee244f974729"}, {"url": "https://git.kernel.org/stable/c/fe9e4d0c39311d0f97b024147a0d155333f388b5"}], "title": "wifi: wilc1000: avoid buffer overflow in WID string configuration", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/microchip/wilc1000/wlan_cfg.c", "drivers/net/wireless/microchip/wilc1000/wlan_cfg.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5f1578a8684794318a60a022cedbffaa3dc444ce", "status": "affected", "version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "versionType": "git"}, {"lessThan": "6085291a1a5865d4ad70f0e5812d524ebd5d1711", "status": "affected", "version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "versionType": "git"}, {"lessThan": "2203ef417044b10a8563ade6a17c74183745d72e", "status": "affected", "version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "versionType": "git"}, {"lessThan": "ae50f8562306a7ea1cf3c9722f97ee244f974729", "status": "affected", "version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "versionType": "git"}, {"lessThan": "fe9e4d0c39311d0f97b024147a0d155333f388b5", "status": "affected", "version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/microchip/wilc1000/wlan_cfg.c", "drivers/net/wireless/microchip/wilc1000/wlan_cfg.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.2"}, {"lessThan": "4.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.108", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.49", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3EE77707-D5B2-456E-8858-EAB202875043", "versionEndExcluding": "6.6.108", "versionStartIncluding": "4.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CAA033E9-A2C5-4976-A83E-9804D8FB827F", "versionEndExcluding": "6.12.49", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "638DD910-1189-4F5E-98BF-2D436B695112", "versionEndExcluding": "6.16.9", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*", "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*", "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: avoid buffer overflow in WID string configuration\n\nFix the following copy overflow warning identified by Smatch checker.\n\n drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame()\n error: '__memcpy()' 'cfg->s[i]->str' copy overflow (512 vs 65537)\n\nThis patch introduces size check before accessing the memory buffer.\nThe checks are base on the WID type of received data from the firmware.\nFor WID string configuration, the size limit is determined by individual\nelement size in 'struct wilc_cfg_str_vals' that is maintained in 'len' field\nof 'struct wilc_cfg_str'."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nwifi: wilc1000: evitar desbordamiento de b\u00fafer en la configuraci\u00f3n de cadena WID\n\nCorrige la siguiente advertencia de desbordamiento de copia identificada por el verificador Smatch.\n\n drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame()\n error: '__memcpy()' 'cfg->s[i]->str' desbordamiento de copia (512 vs 65537)\n\nEste parche introduce una comprobaci\u00f3n de tama\u00f1o antes de acceder al b\u00fafer de memoria.\nLas comprobaciones se basan en el tipo WID de los datos recibidos del firmware.\nPara la configuraci\u00f3n de cadena WID, el l\u00edmite de tama\u00f1o est\u00e1 determinado por el tama\u00f1o de elemento individual en 'struct wilc_cfg_str_vals' que se mantiene en el campo 'len' de 'struct wilc_cfg_str'."}], "id": "CVE-2025-39952", "lastModified": "2026-10-30T13:18:11.903", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-10-04T08:15:48.507", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2203ef417044b10a8563ade6a17c74183745d72e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5f1578a8684794318a60a022cedbffaa3dc444ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6085291a1a5865d4ad70f0e5812d524ebd5d1711"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ae50f8562306a7ea1cf3c9722f97ee244f974729"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fe9e4d0c39311d0f97b024147a0d155333f388b5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: wifi: wilc1000: avoid buffer overflow in WID string configuration", "id": "2401429", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2401429"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: wilc1000: avoid buffer overflow in WID string configuration\nFix the following copy overflow warning identified by Smatch checker.\ndrivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame()\nerror: '__memcpy()' 'cfg->s[i]->str' copy overflow (512 vs 65537)\nThis patch introduces size check before accessing the memory buffer.\nThe checks are base on the WID type of received data from the firmware.\nFor WID string configuration, the size limit is determined by individual\nelement size in 'struct wilc_cfg_str_vals' that is maintained in 'len' field\nof 'struct wilc_cfg_str'."], "name": "CVE-2025-39952", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:rhivos:1", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat In-Vehicle Operating System 1"}], "public_date": "2025-10-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39952\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39952\nhttps://lore.kernel.org/linux-cve-announce/2025100421-CVE-2025-39952-e36c@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-06T14:41:58.657428+00:00", "updated": "2025-10-06T14:41:58.657521+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}