CVE-2025-39891None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Initialize the chan_stats array to zero The adapter->chan_stats[] array is initialized in mwifiex_init_channel_scan_gap() with vmalloc(), which doesn't …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: Initialize the chan_stats array to zero
The adapter->chan_stats[] array is initialized in mwifiex_init_channel_scan_gap() with vmalloc(), which doesn't zero out memory. The array is filled in mwifiex_update_chan_statistics() and then the user can query the data in mwifiex_cfg80211_dump_survey().
There are two potential issues here. What if the user calls mwifiex_cfg80211_dump_survey() before the data has been filled in. Also the mwifiex_update_chan_statistics() function doesn't necessarily initialize the whole array. Since the array was not initialized at the start that could result in an information leak.
Also this array is pretty small. It's a maximum of 900 bytes so it's more appropriate to use kcalloc() instead vmalloc().
Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 05daef0442d28350a1a0d6d0e2cab4a7a91df475Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < acdf26a912190fc6746e2a890d7d0338190527b4Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 32c124c9c03aa755cbaf60ef7f76afd918d47659Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 9df29aa5637d94d24f7c5f054ef4feaa7b766111Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 06616410a3e5e6cd1de5b7cbc668f1a7edeedad9Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 5285b7009dc1e09d5bb9e05fae82e1a807882dbcLinux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 0e20450829ca3c1dbc2db536391537c57a40fe0bLinux 3.19Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses