diff --git a/os_if/linux/scan/src/wlan_cfg80211_scan.c b/os_if/linux/scan/src/wlan_cfg80211_scan.c
index 33742032d0d2..8e0f964b3d95 100644
--- a/os_if/linux/scan/src/wlan_cfg80211_scan.c
+++ b/os_if/linux/scan/src/wlan_cfg80211_scan.c
@@ -447,10 +447,14 @@ int wlan_cfg80211_sched_scan_start(struct wlan_objmgr_vdev *vdev,
 
 	enable_dfs_pno_chnl_scan = ucfg_scan_is_dfs_chnl_scan_enabled(psoc);
 	if (request->n_channels) {
-		char chl[(request->n_channels * 5) + 1];
+		char *chl = qdf_mem_malloc((request->n_channels * 5) + 1);
 		int len = 0;
 		bool ap_or_go_present = wlan_cfg80211_is_ap_go_present(psoc);
 
+		if (!chl) {
+			ret = -ENOMEM;
+			goto error;
+		}
 		for (i = 0; i < request->n_channels; i++) {
 			channel = request->channels[i]->hw_value;
 			if ((!enable_dfs_pno_chnl_scan) &&
@@ -471,6 +475,8 @@ int wlan_cfg80211_sched_scan_start(struct wlan_objmgr_vdev *vdev,
 								  &ok);
 				if (QDF_IS_STATUS_ERROR(status)) {
 					cfg80211_err("DNBS check failed");
+					qdf_mem_free(chl);
+					chl = NULL;
 					ret = -EINVAL;
 					goto error;
 				}
@@ -482,6 +488,8 @@ int wlan_cfg80211_sched_scan_start(struct wlan_objmgr_vdev *vdev,
 		}
 		cfg80211_notice("No. of Scan Channels: %d", num_chan);
 		cfg80211_notice("Channel-List: %s", chl);
+		qdf_mem_free(chl);
+		chl = NULL;
 		/* If all channels are DFS and dropped,
 		 * then ignore the PNO request
 		 */
@@ -1410,7 +1418,7 @@ int wlan_cfg80211_scan(struct wlan_objmgr_vdev *vdev,
 		qdf_set_macaddr_broadcast(&req->scan_req.bssid_list[0]);
 
 	if (request->n_channels) {
-		char chl[(request->n_channels * 5) + 1];
+		char *chl = qdf_mem_malloc((request->n_channels * 5) + 1);
 		int len = 0;
 #ifdef WLAN_POLICY_MGR_ENABLE
 		bool ap_or_go_present =
@@ -1419,7 +1427,10 @@ int wlan_cfg80211_scan(struct wlan_objmgr_vdev *vdev,
 			     policy_mgr_mode_specific_connection_count(
 			     psoc, PM_P2P_GO_MODE, NULL);
 #endif
-
+		if (!chl) {
+			ret = -ENOMEM;
+			goto end;
+		}
 		for (i = 0; i < request->n_channels; i++) {
 			channel = request->channels[i]->hw_value;
 			c_freq = wlan_reg_chan_to_freq(pdev, channel);
@@ -1437,6 +1448,8 @@ int wlan_cfg80211_scan(struct wlan_objmgr_vdev *vdev,
 				if (QDF_IS_STATUS_ERROR(qdf_status)) {
 					cfg80211_err("DNBS check failed");
 					qdf_mem_free(req);
+					qdf_mem_free(chl);
+					chl = NULL;
 					ret = -EINVAL;
 					goto end;
 				}
@@ -1458,6 +1471,8 @@ int wlan_cfg80211_scan(struct wlan_objmgr_vdev *vdev,
 				break;
 		}
 		cfg80211_info("Channel-List: %s", chl);
+		qdf_mem_free(chl);
+		chl = NULL;
 		cfg80211_info("No. of Scan Channels: %d", num_chan);
 	}
 	if (!num_chan) {