CVE-2025-39891

{"id": "CVE-2025-39891", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "bf35443314acb43fa8a3f9f8046e14cbe178762b", "lessThan": "9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65", "versionType": "git"}, {"status": "affected", "version": "bf35443314acb43fa8a3f9f8046e14cbe178762b", "lessThan": "05daef0442d28350a1a0d6d0e2cab4a7a91df475", "versionType": "git"}, {"status": "affected", "version": "bf35443314acb43fa8a3f9f8046e14cbe178762b", "lessThan": "acdf26a912190fc6746e2a890d7d0338190527b4", "versionType": "git"}, {"status": "affected", "version": "bf35443314acb43fa8a3f9f8046e14cbe178762b", "lessThan": "32c124c9c03aa755cbaf60ef7f76afd918d47659", "versionType": "git"}, {"status": "affected", "version": "bf35443314acb43fa8a3f9f8046e14cbe178762b", "lessThan": "9df29aa5637d94d24f7c5f054ef4feaa7b766111", "versionType": "git"}, {"status": "affected", "version": "bf35443314acb43fa8a3f9f8046e14cbe178762b", "lessThan": "06616410a3e5e6cd1de5b7cbc668f1a7edeedad9", "versionType": "git"}, {"status": "affected", "version": "bf35443314acb43fa8a3f9f8046e14cbe178762b", "lessThan": "5285b7009dc1e09d5bb9e05fae82e1a807882dbc", "versionType": "git"}, {"status": "affected", "version": "bf35443314acb43fa8a3f9f8046e14cbe178762b", "lessThan": "0e20450829ca3c1dbc2db536391537c57a40fe0b", "versionType": "git"}], "programFiles": ["drivers/net/wireless/marvell/mwifiex/cfg80211.c", "drivers/net/wireless/marvell/mwifiex/main.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.19"}, {"status": "unaffected", "version": "0", "lessThan": "3.19", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.299", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.243", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.192", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.151", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.105", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.46", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.16.6", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/marvell/mwifiex/cfg80211.c", "drivers/net/wireless/marvell/mwifiex/main.c"], "defaultStatus": "affected"}]}], "published": "2025-10-01T08:15:31.570", "references": [{"url": "https://git.kernel.org/stable/c/05daef0442d28350a1a0d6d0e2cab4a7a91df475", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/06616410a3e5e6cd1de5b7cbc668f1a7edeedad9", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/0e20450829ca3c1dbc2db536391537c57a40fe0b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/32c124c9c03aa755cbaf60ef7f76afd918d47659", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5285b7009dc1e09d5bb9e05fae82e1a807882dbc", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9df29aa5637d94d24f7c5f054ef4feaa7b766111", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/acdf26a912190fc6746e2a890d7d0338190527b4", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Initialize the chan_stats array to zero\n\nThe adapter->chan_stats[] array is initialized in\nmwifiex_init_channel_scan_gap() with vmalloc(), which doesn't zero out\nmemory. The array is filled in mwifiex_update_chan_statistics()\nand then the user can query the data in mwifiex_cfg80211_dump_survey().\n\nThere are two potential issues here. What if the user calls\nmwifiex_cfg80211_dump_survey() before the data has been filled in.\nAlso the mwifiex_update_chan_statistics() function doesn't necessarily\ninitialize the whole array. Since the array was not initialized at\nthe start that could result in an information leak.\n\nAlso this array is pretty small. It's a maximum of 900 bytes so it's\nmore appropriate to use kcalloc() instead vmalloc()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: mwifiex: Inicializar el array chan_stats a cero\n\nEl array adapter->chan_stats[] se inicializa en mwifiex_init_channel_scan_gap() con vmalloc(), que no pone a cero la memoria. El array se rellena en mwifiex_update_chan_statistics() y luego el usuario puede consultar los datos en mwifiex_cfg80211_dump_survey().\n\nHay dos problemas potenciales aqu\u00ed. \u00bfQu\u00e9 pasa si el usuario llama a mwifiex_cfg80211_dump_survey() antes de que los datos se hayan rellenado? Adem\u00e1s, la funci\u00f3n mwifiex_update_chan_statistics() no inicializa necesariamente todo el array. Dado que el array no se inicializ\u00f3 al principio, eso podr\u00eda resultar en una fuga de informaci\u00f3n.\n\nAdem\u00e1s, este array es bastante peque\u00f1o. Es un m\u00e1ximo de 900 bytes, por lo que es m\u00e1s apropiado usar kcalloc() en lugar de vmalloc()."}], "lastModified": "2026-10-19T21:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3E50ACD-9640-4D8A-8C45-1D4377081607", "versionEndExcluding": "5.4.299", "versionStartIncluding": "3.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DE4B49A-F1A3-4F0C-96D3-68676CE6BB4C", "versionEndExcluding": "5.10.243", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A911BD7-361F-45C0-A4A6-33FCBA0F6117", "versionEndExcluding": "5.15.192", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC2D0B88-F133-4143-B91D-0A439AA143C0", "versionEndExcluding": "6.1.151", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9364B0C-6B18-422E-8254-73EF0E856875", "versionEndExcluding": "6.6.105", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7E2B332-E920-4CAC-B400-288602DB6F16", "versionEndExcluding": "6.12.46", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "548F104C-0F08-438B-9C97-64C903F0C678", "versionEndExcluding": "6.16.6", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}