Information Leak in Linux Kernel's mwifiex Wireless Adapter

CVE-2025-39891

What is CVE-2025-39891?

A vulnerability has been identified in the mwifiex wireless adapter of the Linux kernel, where the chan_stats array is not properly initialized before use. This lack of initialization can lead to an information leak if the user accesses the array before it has been populated with valid data. The mwifiex_update_chan_statistics() function does not guarantee the entire array is initialized, creating further risks. For optimal safety, it is recommended that the chan_stats array be allocated using kcalloc() instead of vmalloc() to ensure it is properly zeroed out, thus mitigating the chance of exposing sensitive information.

References