THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2025-39991 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is not allocated, then fw is dereferenced to be passed to ath11k_err

[NVD] CVE-2025-39991 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is not allocated, then fw is dereferenced to be passed to ath11k_err

lownvdPublished 2025-10-15

CVE-2025-39991 CVSS: None Published: 2025-10-15T08:15:37.197

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()

If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is not allocated, then fw is dereferenced to be passed to ath11k_err function.

Replace fw->size by m3_len.

Found by Linux V

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-39991