In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: Initialize the chan_stats array to zero
The adapter->chanstats[] array is initialized in mwifiexinitchannelscangap() with vmalloc(), which doesn't zero out memory. The array is filled in mwifiexupdatechanstatistics() and then the user can query the data in mwifiexcfg80211dump_survey().
There are two potential issues here. What if the user calls mwifiexcfg80211dumpsurvey() before the data has been filled in. Also the mwifiexupdatechanstatistics() function doesn't necessarily initialize the whole array. Since the array was not initialized at the start that could result in an information leak.
Also this array is pretty small. It's a maximum of 900 bytes so it's more appropriate to use kcalloc() instead vmalloc().
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05daef0442d28350a1a0d6d0e2cab4a7a91df475",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "288334670237827649788896506134060749724",
"length": 393.0
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/cfg80211.c",
"function": "mwifiex_init_channel_scan_gap"
},
"id": "CVE-2025-39891-0828ec5c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5285b7009dc1e09d5bb9e05fae82e1a807882dbc",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164257443917987716946514887455735323255",
"127078929437646578658494562358974309659",
"165333297592266422792384074644370278489",
"5176916612152950066985172310173575919",
"264344460975039473687108105412610018602"
]
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/cfg80211.c"
},
"id": "CVE-2025-39891-0a3ae148"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164257443917987716946514887455735323255",
"127078929437646578658494562358974309659",
"165333297592266422792384074644370278489",
"5176916612152950066985172310173575919",
"264344460975039473687108105412610018602"
]
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/cfg80211.c"
},
"id": "CVE-2025-39891-1224913a"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32c124c9c03aa755cbaf60ef7f76afd918d47659",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"219286457362733314279419207038381969132",
"85209942633468743959442976993649705687",
"51833126938887884733970028034618151597",
"228930415640693876585167962271808001455",
"206550011773458310376903603939876257617",
"102498079429252458719639981974250742804",
"206931312820642413245451281846974516379",
"274761282074810279914290582157274807386"
]
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/main.c"
},
"id": "CVE-2025-39891-12b46cb2"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32c124c9c03aa755cbaf60ef7f76afd918d47659",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "288334670237827649788896506134060749724",
"length": 393.0
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/cfg80211.c",
"function": "mwifiex_init_channel_scan_gap"
},
"id": "CVE-2025-39891-32bbd6c6"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32c124c9c03aa755cbaf60ef7f76afd918d47659",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164257443917987716946514887455735323255",
"127078929437646578658494562358974309659",
"165333297592266422792384074644370278489",
"5176916612152950066985172310173575919",
"264344460975039473687108105412610018602"
]
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/cfg80211.c"
},
"id": "CVE-2025-39891-3b59042b"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5285b7009dc1e09d5bb9e05fae82e1a807882dbc",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"219286457362733314279419207038381969132",
"85209942633468743959442976993649705687",
"51833126938887884733970028034618151597",
"228930415640693876585167962271808001455",
"206550011773458310376903603939876257617",
"102498079429252458719639981974250742804",
"206931312820642413245451281846974516379",
"274761282074810279914290582157274807386"
]
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/main.c"
},
"id": "CVE-2025-39891-4aa863f7"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "288334670237827649788896506134060749724",
"length": 393.0
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/cfg80211.c",
"function": "mwifiex_init_channel_scan_gap"
},
"id": "CVE-2025-39891-53255966"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acdf26a912190fc6746e2a890d7d0338190527b4",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"219286457362733314279419207038381969132",
"85209942633468743959442976993649705687",
"51833126938887884733970028034618151597",
"228930415640693876585167962271808001455",
"206550011773458310376903603939876257617",
"102498079429252458719639981974250742804",
"206931312820642413245451281846974516379",
"274761282074810279914290582157274807386"
]
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/main.c"
},
"id": "CVE-2025-39891-55ef2909"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05daef0442d28350a1a0d6d0e2cab4a7a91df475",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164257443917987716946514887455735323255",
"127078929437646578658494562358974309659",
"165333297592266422792384074644370278489",
"5176916612152950066985172310173575919",
"264344460975039473687108105412610018602"
]
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/cfg80211.c"
},
"id": "CVE-2025-39891-5908587a"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06616410a3e5e6cd1de5b7cbc668f1a7edeedad9",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"219286457362733314279419207038381969132",
"85209942633468743959442976993649705687",
"51833126938887884733970028034618151597",
"228930415640693876585167962271808001455",
"206550011773458310376903603939876257617",
"102498079429252458719639981974250742804",
"206931312820642413245451281846974516379",
"274761282074810279914290582157274807386"
]
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/main.c"
},
"id": "CVE-2025-39891-5e4422f7"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e20450829ca3c1dbc2db536391537c57a40fe0b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"219286457362733314279419207038381969132",
"85209942633468743959442976993649705687",
"51833126938887884733970028034618151597",
"228930415640693876585167962271808001455",
"206550011773458310376903603939876257617",
"102498079429252458719639981974250742804",
"206931312820642413245451281846974516379",
"274761282074810279914290582157274807386"
]
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/main.c"
},
"id": "CVE-2025-39891-6688c628"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06616410a3e5e6cd1de5b7cbc668f1a7edeedad9",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164257443917987716946514887455735323255",
"127078929437646578658494562358974309659",
"165333297592266422792384074644370278489",
"5176916612152950066985172310173575919",
"264344460975039473687108105412610018602"
]
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/cfg80211.c"
},
"id": "CVE-2025-39891-804170df"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05daef0442d28350a1a0d6d0e2cab4a7a91df475",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"219286457362733314279419207038381969132",
"85209942633468743959442976993649705687",
"51833126938887884733970028034618151597",
"228930415640693876585167962271808001455",
"206550011773458310376903603939876257617",
"102498079429252458719639981974250742804",
"206931312820642413245451281846974516379",
"274761282074810279914290582157274807386"
]
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/main.c"
},
"id": "CVE-2025-39891-85c98de8"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e20450829ca3c1dbc2db536391537c57a40fe0b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "288334670237827649788896506134060749724",
"length": 393.0
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/cfg80211.c",
"function": "mwifiex_init_channel_scan_gap"
},
"id": "CVE-2025-39891-8e921284"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e20450829ca3c1dbc2db536391537c57a40fe0b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164257443917987716946514887455735323255",
"127078929437646578658494562358974309659",
"165333297592266422792384074644370278489",
"5176916612152950066985172310173575919",
"264344460975039473687108105412610018602"
]
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/cfg80211.c"
},
"id": "CVE-2025-39891-9b003287"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acdf26a912190fc6746e2a890d7d0338190527b4",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "288334670237827649788896506134060749724",
"length": 393.0
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/cfg80211.c",
"function": "mwifiex_init_channel_scan_gap"
},
"id": "CVE-2025-39891-ba0e0c7f"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acdf26a912190fc6746e2a890d7d0338190527b4",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164257443917987716946514887455735323255",
"127078929437646578658494562358974309659",
"165333297592266422792384074644370278489",
"5176916612152950066985172310173575919",
"264344460975039473687108105412610018602"
]
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/cfg80211.c"
},
"id": "CVE-2025-39891-d9f496ea"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"219286457362733314279419207038381969132",
"85209942633468743959442976993649705687",
"51833126938887884733970028034618151597",
"228930415640693876585167962271808001455",
"206550011773458310376903603939876257617",
"102498079429252458719639981974250742804",
"206931312820642413245451281846974516379",
"274761282074810279914290582157274807386"
]
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/main.c"
},
"id": "CVE-2025-39891-dd57518d"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5285b7009dc1e09d5bb9e05fae82e1a807882dbc",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "288334670237827649788896506134060749724",
"length": 393.0
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/cfg80211.c",
"function": "mwifiex_init_channel_scan_gap"
},
"id": "CVE-2025-39891-f294cb7e"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06616410a3e5e6cd1de5b7cbc668f1a7edeedad9",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "288334670237827649788896506134060749724",
"length": 393.0
},
"target": {
"file": "drivers/net/wireless/marvell/mwifiex/cfg80211.c",
"function": "mwifiex_init_channel_scan_gap"
},
"id": "CVE-2025-39891-f82cdbd2"
}
]