{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2025-39891","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2025-10-01T08:15:31.570","lastModified":"2026-11-05T22:17:34.790","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Initialize the chan_stats array to zero\n\nThe adapter-\u003echan_stats[] array is initialized in\nmwifiex_init_channel_scan_gap() with vmalloc(), which doesn't zero out\nmemory.  The array is filled in mwifiex_update_chan_statistics()\nand then the user can query the data in mwifiex_cfg80211_dump_survey().\n\nThere are two potential issues here.  What if the user calls\nmwifiex_cfg80211_dump_survey() before the data has been filled in.\nAlso the mwifiex_update_chan_statistics() function doesn't necessarily\ninitialize the whole array.  Since the array was not initialized at\nthe start that could result in an information leak.\n\nAlso this array is pretty small.  It's a maximum of 900 bytes so it's\nmore appropriate to use kcalloc() instead vmalloc()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: mwifiex: Inicializar el array chan_stats a cero\n\nEl array adapter-\u003echan_stats[] se inicializa en mwifiex_init_channel_scan_gap() con vmalloc(), que no pone a cero la memoria. El array se rellena en mwifiex_update_chan_statistics() y luego el usuario puede consultar los datos en mwifiex_cfg80211_dump_survey().\n\nHay dos problemas potenciales aquí. ¿Qué pasa si el usuario llama a mwifiex_cfg80211_dump_survey() antes de que los datos se hayan rellenado? Además, la función mwifiex_update_chan_statistics() no inicializa necesariamente todo el array. Dado que el array no se inicializó al principio, eso podría resultar en una fuga de información.\n\nAdemás, este array es bastante pequeño. Es un máximo de 900 bytes, por lo que es más apropiado usar kcalloc() en lugar de vmalloc()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/marvell/mwifiex/cfg80211.c","drivers/net/wireless/marvell/mwifiex/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bf35443314acb43fa8a3f9f8046e14cbe178762b","lessThan":"9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65","versionType":"git","status":"affected"},{"version":"bf35443314acb43fa8a3f9f8046e14cbe178762b","lessThan":"05daef0442d28350a1a0d6d0e2cab4a7a91df475","versionType":"git","status":"affected"},{"version":"bf35443314acb43fa8a3f9f8046e14cbe178762b","lessThan":"acdf26a912190fc6746e2a890d7d0338190527b4","versionType":"git","status":"affected"},{"version":"bf35443314acb43fa8a3f9f8046e14cbe178762b","lessThan":"32c124c9c03aa755cbaf60ef7f76afd918d47659","versionType":"git","status":"affected"},{"version":"bf35443314acb43fa8a3f9f8046e14cbe178762b","lessThan":"9df29aa5637d94d24f7c5f054ef4feaa7b766111","versionType":"git","status":"affected"},{"version":"bf35443314acb43fa8a3f9f8046e14cbe178762b","lessThan":"06616410a3e5e6cd1de5b7cbc668f1a7edeedad9","versionType":"git","status":"affected"},{"version":"bf35443314acb43fa8a3f9f8046e14cbe178762b","lessThan":"5285b7009dc1e09d5bb9e05fae82e1a807882dbc","versionType":"git","status":"affected"},{"version":"bf35443314acb43fa8a3f9f8046e14cbe178762b","lessThan":"0e20450829ca3c1dbc2db536391537c57a40fe0b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/marvell/mwifiex/cfg80211.c","drivers/net/wireless/marvell/mwifiex/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.19","status":"affected"},{"version":"0","lessThan":"3.19","versionType":"semver","status":"unaffected"},{"version":"5.4.299","lessThanOrEqual":"5.4.*","versionType":"semver","status":"unaffected"},{"version":"5.10.243","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.192","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.151","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.105","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.46","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.16.6","lessThanOrEqual":"6.16.*","versionType":"semver","status":"unaffected"},{"version":"6.17","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-05T21:12:54.418209Z","id":"CVE-2025-39891","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.19","versionEndExcluding":"5.4.299","matchCriteriaId":"B3E50ACD-9640-4D8A-8C45-1D4377081607"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.243","matchCriteriaId":"6DE4B49A-F1A3-4F0C-96D3-68676CE6BB4C"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.192","matchCriteriaId":"8A911BD7-361F-45C0-A4A6-33FCBA0F6117"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.151","matchCriteriaId":"BC2D0B88-F133-4143-B91D-0A439AA143C0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.105","matchCriteriaId":"B9364B0C-6B18-422E-8254-73EF0E856875"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.46","matchCriteriaId":"F7E2B332-E920-4CAC-B400-288602DB6F16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.16.6","matchCriteriaId":"548F104C-0F08-438B-9C97-64C903F0C678"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*","matchCriteriaId":"327D22EF-390B-454C-BD31-2ED23C998A1C"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*","matchCriteriaId":"C730CD9A-D969-4A8E-9522-162AAF7C0EE9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*","matchCriteriaId":"39982C4B-716E-4B2F-8196-FA301F47807D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*","matchCriteriaId":"340BEEA9-D70D-4290-B502-FBB1032353B1"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/05daef0442d28350a1a0d6d0e2cab4a7a91df475","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/06616410a3e5e6cd1de5b7cbc668f1a7edeedad9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/0e20450829ca3c1dbc2db536391537c57a40fe0b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/32c124c9c03aa755cbaf60ef7f76afd918d47659","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/5285b7009dc1e09d5bb9e05fae82e1a807882dbc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/9df29aa5637d94d24f7c5f054ef4feaa7b766111","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/acdf26a912190fc6746e2a890d7d0338190527b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}}