---
id: CVE-2025-39991
title: 'wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()

  If ab->fw.m3_data points to data, then fw pointer remains null.
  Further, if m3_mem is not allocated, then fw…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 98e373dc08187c3f1cd97342b369fa2b0f24005e <
    7554d498e4283c3b4559795abd175eb24a84f47f
  - >-
    Linux >= 7db88b962f06a52af5e9a32971012e8f3427cec0 <
    1f52119809b76d43759fc47da1cf708690b740a1
  - >-
    Linux >= 7db88b962f06a52af5e9a32971012e8f3427cec0 <
    888830b2cbc035838bebefe94502976da94332a5
  - >-
    Linux >= 7db88b962f06a52af5e9a32971012e8f3427cec0 <
    500fcc31e488d798937a23dbb1f62db46820c5b2
  - >-
    Linux >= 7db88b962f06a52af5e9a32971012e8f3427cec0 <
    3fd2ef2ae2b5c955584a3bee8e83ae7d7a98f782
  - Linux 6.7
published: '2025-10-15'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T11:58:06.488Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39991'
references:
  - url: 'https://git.kernel.org/stable/c/7554d498e4283c3b4559795abd175eb24a84f47f'
  - url: 'https://git.kernel.org/stable/c/1f52119809b76d43759fc47da1cf708690b740a1'
  - url: 'https://git.kernel.org/stable/c/888830b2cbc035838bebefe94502976da94332a5'
  - url: 'https://git.kernel.org/stable/c/500fcc31e488d798937a23dbb1f62db46820c5b2'
  - url: 'https://git.kernel.org/stable/c/3fd2ef2ae2b5c955584a3bee8e83ae7d7a98f782'
tags:
  - cve.org
epss: 0.00201
epssPercentile: 0.08848
ingestedAt: '2026-09-14T15:23:07.459Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()

If ab->fw.m3_data points to data, then fw pointer remains null.
Further, if m3_mem is not allocated, then fw is dereferenced to be
passed to ath11k_err function.

Replace fw->size by m3_len.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

## Affected

- `Linux >= 98e373dc08187c3f1cd97342b369fa2b0f24005e < 7554d498e4283c3b4559795abd175eb24a84f47f`
- `Linux >= 7db88b962f06a52af5e9a32971012e8f3427cec0 < 1f52119809b76d43759fc47da1cf708690b740a1`
- `Linux >= 7db88b962f06a52af5e9a32971012e8f3427cec0 < 888830b2cbc035838bebefe94502976da94332a5`
- `Linux >= 7db88b962f06a52af5e9a32971012e8f3427cec0 < 500fcc31e488d798937a23dbb1f62db46820c5b2`
- `Linux >= 7db88b962f06a52af5e9a32971012e8f3427cec0 < 3fd2ef2ae2b5c955584a3bee8e83ae7d7a98f782`
- `Linux 6.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.