CVE-2025-39891
published 2025-10-01CVE-2025-39891: In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Initialize the chan_stats array to zero The adapter->chan_stats[] array is…
high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: Initialize the chan_stats array to zero
The adapter->chan_stats[] array is initialized in
mwifiex_init_channel_scan_gap() with vmalloc(), which doesn't zero out
memory. The array is filled in mwifiex_update_chan_statistics()
and then the user can query the data in mwifiex_cfg80211_dump_survey().
There are two potential issues here. What if the user calls
mwifiex_cfg80211_dump_survey() before the data has been filled in.
Also the mwifiex_update_chan_statistics() function doesn't necessarily
initialize the whole array. Since the array was not initialized at
the start that could result in an information leak.
Also this array is pretty small. It's a maximum of 900 bytes so it's
more appropriate to use kcalloc() instead vmalloc().
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.153-1 (bookworm) | linux 6.1.153-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.153-1 (bookworm) | linux 6.1.153-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65 | 9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65 |
| linux | linux | >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 05daef0442d28350a1a0d6d0e2cab4a7a91df475 | 05daef0442d28350a1a0d6d0e2cab4a7a91df475 |
| linux | linux | >= bf35443314acb43fa8a3f9f8046e14cbe178762b < acdf26a912190fc6746e2a890d7d0338190527b4 | acdf26a912190fc6746e2a890d7d0338190527b4 |
| linux | linux | >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 32c124c9c03aa755cbaf60ef7f76afd918d47659 | 32c124c9c03aa755cbaf60ef7f76afd918d47659 |
| linux | linux | >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 9df29aa5637d94d24f7c5f054ef4feaa7b766111 | 9df29aa5637d94d24f7c5f054ef4feaa7b766111 |
| linux | linux | >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 06616410a3e5e6cd1de5b7cbc668f1a7edeedad9 | 06616410a3e5e6cd1de5b7cbc668f1a7edeedad9 |
| linux | linux | >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 5285b7009dc1e09d5bb9e05fae82e1a807882dbc | 5285b7009dc1e09d5bb9e05fae82e1a807882dbc |
| linux | linux | >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 0e20450829ca3c1dbc2db536391537c57a40fe0b | 0e20450829ca3c1dbc2db536391537c57a40fe0b |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.244-1 | 5.10.244-1 |
| linux | linux_kernel | >= 0 < 6.1.153-1 | 6.1.153-1 |
| linux | linux_kernel | >= 0 < 6.12.48-1 | 6.12.48-1 |
| linux | linux_kernel | >= 0 < 6.16.6-1 | 6.16.6-1 |
| linux | linux_kernel | >= 0 < 5.15.0-163.173 | 5.15.0-163.173 |
| linux | linux_kernel | >= 0 < 6.8.0-106.106 | 6.8.0-106.106 |
| linux | linux_kernel | >= 3.19 < 5.4.299 | 5.4.299 |
| linux | linux_kernel | >= 5.11 < 5.15.192 | 5.15.192 |
| linux | linux_kernel | >= 5.16 < 6.1.151 | 6.1.151 |
| linux | linux_kernel | >= 5.5 < 5.10.243 | 5.10.243 |
| linux | linux_kernel | >= 6.13 < 6.16.6 | 6.16.6 |
| linux | linux_kernel | >= 6.2 < 6.6.105 | 6.6.105 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH