CVE-2025-39891: wifi: mwifiex: Initialize the chan_stats array to zero
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: Initialize the chanstats array to zero
The adapter->chanstats[] array is initialized in mwifiexinitchannelscangap() with vmalloc(), which doesn't zero out memory. The array is filled in mwifiexupdatechanstatistics() and then the user can query the data in mwifiexcfg80211dumpsurvey().
There are two potential issues here. What if the user calls mwifiexcfg80211dumpsurvey() before the data has been filled in. Also the mwifiexupdatechanstatistics() function doesn't necessarily initialize the whole array. Since the array was not initialized at the start that could result in an information leak.
Also this array is pretty small. It's a maximum of 900 bytes so it's more appropriate to use kcalloc() instead vmalloc().
Affected Software
Remediation
Event History
Frequently Asked Questions
What does CVE-2025-39891 affect?
CVE-2025-39891 affects the Linux kernel's mwifiex driver used for Wi-Fi functionality.
What is the nature of the vulnerability CVE-2025-39891?
CVE-2025-39891 involves the initialization of the chan_stats array in mwifiex, which is not being zeroed out correctly.
What are the potential consequences of CVE-2025-39891 if left unpatched?
If left unpatched, CVE-2025-39891 could lead to potential information leaks and unpredictable behavior in Wi-Fi operations.
How can CVE-2025-39891 be mitigated?
CVE-2025-39891 can be mitigated by updating the Linux kernel to the latest stable version that includes the necessary fix.
What fix has been implemented for CVE-2025-39891?
The fix for CVE-2025-39891 involves ensuring the chan_stats array is properly initialized to zero during the mwifiex initialization process.