CVE-2025-39957

A flaw was found in the Linux kernel Wi-Fi stack (mac80211) in the way S1G capability length is accounted during scan preparation. Missing S1G bytes caused a buffer length validation failure and warnings, blocking hardware scanning. A local user could use this flaw to prevent wireless scanning on the system, resulting in a denial of service for scan operations.

ieee80211_prep_hw_scan() computed scan_ies_len without including the S1G capability element. The mismatch tripped a length check and triggered a WARN in __ieee80211_start_scan(), effectively disabling hardware scans until corrected. The change increases scan_ies_len to accommodate S1G.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module mac80211 from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.