CVE-2025-39991 wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
A NULL pointer dereference in the ath11k WiFi driver can cause a kernel crash, leading to denial of service for local attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39991?
CVE-2025-39991 is a vulnerability in Linux, published on 15 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is not allocated, then fw is dereferenced to be passed to ath11k_err function.
Replace fw->size by m3_len.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Which versions are affected by CVE-2025-39991?
How do I fix CVE-2025-39991?
Apply the vendor's patch.
Is CVE-2025-39991 being exploited?
There is no known exploitation of CVE-2025-39991 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-39991, DEBIAN-CVE-2025-39991, GHSA-2v74-9vqm-pm8p, ROOT-OS-UBUNTU-2404-CVE-2025-39991, UBUNTU-CVE-2025-39991.