CVE-2025-39890 – This CVE describes a memory leak vulnerability ... (How to Fix)

Q: What is the severity of CVE-2025-39890?

CVE-2025-39890 has a CVSS score of 5.5 (MEDIUM). This CVE describes a memory leak vulnerability in the Linux kernel's ath12k WiFi driver. When the ath12k_service_ready_ext_event() function encounters an error condition, it fails to free allocated memory for MAC/PHY capabilities data, causing a kernel memory leak. This affects systems using Qualcomm Atheros ath12k WiFi hardware with vulnerable kernel versions.

📋 TL;DR

This CVE describes a memory leak vulnerability in the Linux kernel's ath12k WiFi driver. When the ath12k_service_ready_ext_event() function encounters an error condition, it fails to free allocated memory for MAC/PHY capabilities data, causing a kernel memory leak. This affects systems using Qualcomm Atheros ath12k WiFi hardware with vulnerable kernel versions.

💻 Affected Systems

Products:

Linux kernel with ath12k driver

Versions: Linux kernel versions containing vulnerable ath12k driver code before the fix commits

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Qualcomm Atheros ath12k WiFi hardware (e.g., QCN9274). The vulnerability is triggered during WiFi service initialization/error handling.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sustained exploitation could lead to kernel memory exhaustion, causing system instability, denial of service, or kernel crashes requiring system reboot.

🟠

Likely Case

Gradual memory consumption over time leading to degraded system performance, potential WiFi connectivity issues, and eventual system instability requiring reboot.

🟢

If Mitigated

Minimal impact with proper monitoring and memory limits; system remains functional but may experience performance degradation over extended periods.

🌐 Internet-Facing: LOW - This vulnerability requires local access to the WiFi subsystem and cannot be triggered remotely over the internet.

🏢 Internal Only: MEDIUM - Requires local system access or ability to interact with WiFi hardware; could be exploited by malicious local users or through WiFi driver interactions.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering the specific error path in ath12k_service_ready_ext_event() function. This typically requires WiFi hardware interaction or driver manipulation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel versions containing commits 1089f65b2de78c7837ef6b4f26146a5a5b0b9749, 3a392f874ac83a77ad0e53eb8aafdbeb787c9298, 89142d34d5602c7447827beb181fa06eb08b9d5c, or 99dbad1b01d3b2f361a9db55c1af1212be497a3d

Vendor Advisory: https://git.kernel.org/stable/c/1089f65b2de78c7837ef6b4f26146a5a5b0b9749

Restart Required: No

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager to update kernel package. 3. For custom kernels: Apply the relevant git commits to ath12k driver code. 4. Rebuild and install kernel if compiling from source.

🔧 Temporary Workarounds

Disable ath12k WiFi

all

Temporarily disable the vulnerable ath12k WiFi driver if not required

modprobe -r ath12k
echo 'blacklist ath12k' >> /etc/modprobe.d/blacklist-ath12k.conf

Monitor kernel memory usage

all

Implement monitoring for kernel memory leaks and alert on abnormal patterns

# Monitor slab memory: cat /proc/slabinfo | grep -i kmalloc
# Monitor memory: watch -n 60 'cat /proc/meminfo | grep -E "Slab|SReclaimable|SUnreclaim"'

🧯 If You Can't Patch

Implement strict memory limits using cgroups to contain potential memory exhaustion
Disable WiFi functionality or use alternative WiFi hardware if available

🔍 How to Verify

Check if Vulnerable:

Check kernel version and ath12k module presence: uname -r && lsmod | grep ath12k

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits or check for memory leak using kmemleak monitoring

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
Out of memory errors in dmesg
ath12k driver error messages

Network Indicators:

WiFi connectivity instability
Increased kernel memory consumption over time

SIEM Query:

source="kernel" AND ("ath12k" OR "memory leak" OR "kmemleak")

📊 Metadata

CVE ID: CVE-2025-39890

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

EPSS Score: 0.02% exploit probability (5.3th percentile)

Published: September 24, 2025

Last Updated: January 14, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-39890, you might also want to check these: