CVE-2025-39991

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s ath11k module related to a NULL dereference within the ath11k qmi m3 load() function. Specifically, if ab->fw.m3 data points to data, the fw pointer can remain null. Subsequently, if m3 mem is not allocated, the null fw pointer is dereferenced when passed to the ath11k err function. The issue is addressed by replacing fw->size with m3 len. This was discovered by the Linux Verification Center (linuxtesting.org) using SVACE.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.