CVE-2025-39991wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
- —Not scoredno CVSS score yet
- 0.20%Exploitation in 30 daysEPSS · top 90% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is not allocated, then fw is dereferenced to be passed to ath11k_err function. Replace fw->size by m3_len. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Timeline
ID reserved
By Linux
- 6 months later
· 6 months later
Published
- 11 months later
· 11 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Deferred.
- EPSS (exploitation in 30 days)
- 0.20% · top 90% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 98e373dc08187c3f1cd97342b369fa2b0f24005e – < 7554d498e4283c3b4559795abd175eb24a84f47f
- affected 7db88b962f06a52af5e9a32971012e8f3427cec0 – < 1f52119809b76d43759fc47da1cf708690b740a1
- affected 7db88b962f06a52af5e9a32971012e8f3427cec0 – < 888830b2cbc035838bebefe94502976da94332a5
- affected 7db88b962f06a52af5e9a32971012e8f3427cec0 – < 500fcc31e488d798937a23dbb1f62db46820c5b2
- affected 7db88b962f06a52af5e9a32971012e8f3427cec0 – < 3fd2ef2ae2b5c955584a3bee8e83ae7d7a98f782
- affected 6.7
- unaffected < 6.7
- unaffected 6.12.51 – ≤ 6.12.*
- unaffected 6.16.11 – ≤ 6.16.*
- unaffected 6.17.1 – ≤ 6.17.*
- unaffected 6.18 – ≤ *
References
References5
- https://git.kernel.org/stable/c/7554d498e4283c3b4559795abd175eb24a84f47f (opens in a new tab)
- https://git.kernel.org/stable/c/1f52119809b76d43759fc47da1cf708690b740a1 (opens in a new tab)
- https://git.kernel.org/stable/c/888830b2cbc035838bebefe94502976da94332a5 (opens in a new tab)
- https://git.kernel.org/stable/c/500fcc31e488d798937a23dbb1f62db46820c5b2 (opens in a new tab)
- https://git.kernel.org/stable/c/3fd2ef2ae2b5c955584a3bee8e83ae7d7a98f782 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-34582 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-39991)Record last updated .