CVE-2025-39890

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. This vulnerability allows increased kernel memory consumption, leading to a denial of service, via malformed firmware/WMI input during device initialization.

Fixes a memory leak in ath12k_service_ready_ext_event() where svc_rdy_ext.mac_phy_caps wasn’t freed on the error path. Impact is limited to kernel memory consumption during device bring-up or error handling when the firmware/WMI “service ready ext” parsing fails. It isn’t triggerable by normal network traffic (requires malformed firmware/WMI input). For the CVSS the PR:H because an attacker would need high privileges or control over device firmware/driver initialization (e.g., loading modified firmware or otherwise influencing WMI events), but not just user-space or over-the-air packets.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.