---
id: CVE-2025-39891
title: 'wifi: mwifiex: Initialize the chan_stats array to zero'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mwifiex: Initialize the chan_stats array to zero

  The adapter->chan_stats[] array is initialized in
  mwifiex_init_channel_scan_gap() with vmalloc(), which doesn't …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b <
    9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65
  - >-
    Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b <
    05daef0442d28350a1a0d6d0e2cab4a7a91df475
  - >-
    Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b <
    acdf26a912190fc6746e2a890d7d0338190527b4
  - >-
    Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b <
    32c124c9c03aa755cbaf60ef7f76afd918d47659
  - >-
    Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b <
    9df29aa5637d94d24f7c5f054ef4feaa7b766111
  - >-
    Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b <
    06616410a3e5e6cd1de5b7cbc668f1a7edeedad9
  - >-
    Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b <
    5285b7009dc1e09d5bb9e05fae82e1a807882dbc
  - >-
    Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b <
    0e20450829ca3c1dbc2db536391537c57a40fe0b
  - Linux 3.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:12:54.418209Z'
published: '2025-10-01'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:06.449Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39891'
references:
  - url: 'https://git.kernel.org/stable/c/9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65'
  - url: 'https://git.kernel.org/stable/c/05daef0442d28350a1a0d6d0e2cab4a7a91df475'
  - url: 'https://git.kernel.org/stable/c/acdf26a912190fc6746e2a890d7d0338190527b4'
  - url: 'https://git.kernel.org/stable/c/32c124c9c03aa755cbaf60ef7f76afd918d47659'
  - url: 'https://git.kernel.org/stable/c/9df29aa5637d94d24f7c5f054ef4feaa7b766111'
  - url: 'https://git.kernel.org/stable/c/06616410a3e5e6cd1de5b7cbc668f1a7edeedad9'
  - url: 'https://git.kernel.org/stable/c/5285b7009dc1e09d5bb9e05fae82e1a807882dbc'
  - url: 'https://git.kernel.org/stable/c/0e20450829ca3c1dbc2db536391537c57a40fe0b'
tags:
  - cve.org
epss: 0.00167
epssPercentile: 0.06015
ingestedAt: '2026-11-05T22:38:32.047Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: Initialize the chan_stats array to zero

The adapter->chan_stats[] array is initialized in
mwifiex_init_channel_scan_gap() with vmalloc(), which doesn't zero out
memory.  The array is filled in mwifiex_update_chan_statistics()
and then the user can query the data in mwifiex_cfg80211_dump_survey().

There are two potential issues here.  What if the user calls
mwifiex_cfg80211_dump_survey() before the data has been filled in.
Also the mwifiex_update_chan_statistics() function doesn't necessarily
initialize the whole array.  Since the array was not initialized at
the start that could result in an information leak.

Also this array is pretty small.  It's a maximum of 900 bytes so it's
more appropriate to use kcalloc() instead vmalloc().

## Affected

- `Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65`
- `Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 05daef0442d28350a1a0d6d0e2cab4a7a91df475`
- `Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < acdf26a912190fc6746e2a890d7d0338190527b4`
- `Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 32c124c9c03aa755cbaf60ef7f76afd918d47659`
- `Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 9df29aa5637d94d24f7c5f054ef4feaa7b766111`
- `Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 06616410a3e5e6cd1de5b7cbc668f1a7edeedad9`
- `Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 5285b7009dc1e09d5bb9e05fae82e1a807882dbc`
- `Linux >= bf35443314acb43fa8a3f9f8046e14cbe178762b < 0e20450829ca3c1dbc2db536391537c57a40fe0b`
- `Linux 3.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.