CVE-2025-39890

What it actually does

Memory leak in the ath12k wireless driver during handling of ath12k_service_ready_ext_event leading to gradual kernel memory exhaustion.

Why it matters to the business

Affected Linux systems with ath12k hardware may suffer performance degradation or instability over extended runtime; low urgency given 398 days since publication, negligible EPSS, and absence from KEV.

How an attack unfolds

An attacker triggers repeated service ready ext events in the ath12k driver to induce leaks; no active exploitation observed despite mentions of unrelated actors like VMSCAPE.

How to fix it

Apply the upstream fix by updating to the Linux kernel commit 99dbad1b01d3b2f361a9db55c1af1212be497a3d or equivalent stable patch; SUSE Linux Enterprise Server 12 SP2-BCL users should update MozillaFirefox to 52.8.1esr-109.34.1 where the driver is present.

How to confirm the fix worked

Confirm kernel source contains commit 99dbad1b01d3b2f361a9db55c1af1212be497a3d and verify no leaks under sustained event load using memory profiling tools.

Typical attack path

1. Identify hosts running vulnerable ath12k driver
2. Repeatedly induce service_ready_ext_event processing
3. Observe progressive memory consumption until OOM conditions

How to detect it

Review kernel logs and memory statistics on systems with ath12k wifi for unexplained allocation growth tied to service ready events; no public threat actor campaigns noted.

What your security team should do

• Patch affected kernels to the listed fixed versions within standard maintenance windows
• Inventory systems using ath12k hardware for targeted deployment
• Monitor EPSS trend and re-evaluate if exploit maturity changes