Executive brief
The Linux kernel's ath11k WiFi driver contains a bug in the M3 firmware loading code that can cause a crash (NULL dereference) when specific firmware configuration conditions occur. This affects systems using ath11k WiFi hardware; a crash in the WiFi driver can cause network connectivity loss or system instability.
Technical details
The vulnerability is a NULL dereference bug in the ath11k_qmi_m3_load() function in drivers/net/wireless/ath/ath11k/qmi.c. When ab->fw.m3_data points to data, the fw pointer remains null. If m3_mem memory allocation fails, the code attempts to dereference the null fw pointer when passing fw->size to the ath11k_err() function for logging. The fix replaces the dereference of fw->size with the local variable m3_len, eliminating the null dereference. This is a simple fix affecting one line of code in the firmware loading path; no special privileges or network access required to trigger during driver initialization.
Affected products
- Linux Linux kernel affected versions include linux-5.x through linux-6.x series
Timeline
- 2025-10-15: disclosed: CVE-2025-39991 published
- 2025-09-18: patched: Patch committed upstream (commit 3fd2ef2ae2b5c955584a3bee8e83ae7d7a98f782)
- 2025-09-17: other: Fix authored by Matvey Kovalev; found by Linux Verification Center with SVACE static analysis