CVE-2025-39991

What it actually does

Null pointer dereference in ath11k_qmi_m3_load() when ab->fw.m3_data is populated but the fw pointer remains uninitialized and is later dereferenced if m3_mem allocation fails.

Why it matters to the business

Systems running affected Linux kernels with ath11k wireless hardware may experience unexpected crashes or instability, disrupting operations on servers and devices using these drivers.

How an attack unfolds

An attacker with local access or the ability to influence firmware loading conditions triggers ath11k_qmi_m3_load() under the specific state where fw is null, causing the kernel to dereference invalid memory during error handling.

How to fix it

Apply the upstream fix or update to kernel versions containing commit 1f52119809b76d43759fc47da1cf708690b740a1; for SUSE Linux Enterprise Server 12 SP1-LTSS and SAP Applications 12 SP1 apply kgraft-patch-SLE12-SP1_Update_24 version 5-2.1.

How to confirm the fix worked

Confirm the running kernel includes commit 1f52119809b76d43759fc47da1cf708690b740a1 or the equivalent SUSE patch; inspect source for replacement of fw->size with m3_len in ath11k_qmi_m3_load().

Typical attack path

1. Gain ability to interact with or initialize the ath11k Wi-Fi driver
2. Force conditions where m3_data is set but m3_mem allocation fails
3. Invoke ath11k_qmi_m3_load() leading to null fw dereference
4. Trigger kernel panic or denial of service

How to detect it

Review kernel logs for oops or panic entries referencing ath11k_qmi_m3_load or null pointer dereferences during QMI firmware operations.

What your security team should do

• Prioritize kernel updates on all systems using ath11k hardware
• Test patches in staging environments before broad deployment
• Monitor vendor advisories for additional affected distributions