CVE-2025-39890: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39890 is a memory leak vulnerability discovered in the Linux kernel's ath12k WiFi driver component. The issue was disclosed on September 24, 2025, affecting the ath12k_service_ready_ext_event function where svc_rdy_ext.mac_phy_caps is not properly freed in failure cases (NVD).

The vulnerability occurs in the ath12k_service_ready_ext_event() function where svc_rdy_ext.mac_phy_caps is not freed in the failure case, resulting in a memory leak. The issue was identified through kmemleak tracking, which detected an unreferenced object of size 1024 bytes. The vulnerability affects the QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 hardware (NVD).

The vulnerability results in a memory leak in the Linux kernel's WiFi subsystem, which could lead to gradual system resource depletion over time. While this may not pose an immediate security risk, it could affect system stability and performance in long-running systems (Ubuntu).

The vulnerability has been fixed in Linux kernel version 6.14.0-32.32 for Ubuntu 25.04 (plucky) and version 6.14.0-32.32~24.04.1 for Ubuntu 24.04 LTS (noble). Users are advised to update their systems to these patched versions. The fix involves properly freeing svc_rdy_ext.mac_phy_caps in the error case (Ubuntu).