CVE-2025-39891

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: Initialize the chan_stats array to zero

The adapter->chanstats[] array is initialized in mwifiexinitchannelscangap() with vmalloc(), which doesn't zero out memory. The array is filled in mwifiexupdatechanstatistics() and then the user can query the data in mwifiexcfg80211dump_survey().

There are two potential issues here. What if the user calls mwifiexcfg80211dumpsurvey() before the data has been filled in. Also the mwifiexupdatechanstatistics() function doesn't necessarily initialize the whole array. Since the array was not initialized at the start that could result in an information leak.

Also this array is pretty small. It's a maximum of 900 bytes so it's more appropriate to use kcalloc() instead vmalloc().