CVE-2025-39991

wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()

State: Published
Severity: Not scored
Published: Oct 15, 2025
Updated: Sep 14, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()

If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is not allocated, then fw is dereferenced to be passed to ath11k_err function.

Replace fw->size by m3_len.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	98e373dc08187c3f1cd97342b369fa2b0f24005e to before 7554d498e4283c3b4559795abd175eb24a84f47fAffected 7db88b962f06a52af5e9a32971012e8f3427cec0 to before 1f52119809b76d43759fc47da1cf708690b740a1Affected 7db88b962f06a52af5e9a32971012e8f3427cec0 to before 888830b2cbc035838bebefe94502976da94332a5Affected 7db88b962f06a52af5e9a32971012e8f3427cec0 to before 500fcc31e488d798937a23dbb1f62db46820c5b2Affected 7db88b962f06a52af5e9a32971012e8f3427cec0 to before 3fd2ef2ae2b5c955584a3bee8e83ae7d7a98f782Affected
LinuxLinux	6.7Affected before 6.7Not affected 6.12.51 through 6.12.Not affected 6.16.11 through 6.16.Not affected 6.17.1 through 6.17.*Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

98e373dc08187c3f1cd97342b369fa2b0f24005e to before 7554d498e4283c3b4559795abd175eb24a84f47fAffected
7db88b962f06a52af5e9a32971012e8f3427cec0 to before 1f52119809b76d43759fc47da1cf708690b740a1Affected
7db88b962f06a52af5e9a32971012e8f3427cec0 to before 888830b2cbc035838bebefe94502976da94332a5Affected
7db88b962f06a52af5e9a32971012e8f3427cec0 to before 500fcc31e488d798937a23dbb1f62db46820c5b2Affected
7db88b962f06a52af5e9a32971012e8f3427cec0 to before 3fd2ef2ae2b5c955584a3bee8e83ae7d7a98f782Affected

LinuxLinux

6.7Affected
before 6.7Not affected
6.12.51 through 6.12.*Not affected
6.16.11 through 6.16.*Not affected
6.17.1 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.