Null Dereference Vulnerability in Linux Kernel Affects ath11k Driver

CVE-2025-39991

What is CVE-2025-39991?

A null dereference vulnerability has been identified in the ath11k driver of the Linux kernel. This issue occurs when the firmware pointer remains null, resulting in potential system instability when m3_mem is not correctly allocated. Appropriate handling has been implemented by replacing the fw->size with m3_len to prevent unintended dereferencing and enhance system security. Discovered through rigorous testing conducted by the Linux Verification Center, this vulnerability underscores the importance of timely code maintenance and patching.

References