CVE-2023-53199

MEDIUM EPSS 4.2%
Published Sep 15, 20259mo ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Sep 15, 2025 9mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream(). While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we have an incorrect pkt_len or pkt_tag, the input skb is considered invalid and dropped. All the associated packets already in skb_pool should be dropped and freed. Added a comment describing this issue. The patch also makes remain_skb NULL after being processed so that it cannot be referenced after potential free. The initialization of hif_dev fields which are associated with remain_skb (rx_remain_len, rx_transfer_len and rx_pad_len) is moved after a new remain_skb is allocated. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
4.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-772

Affected Products 6

VendorProductVersionRange
linuxlinux_kernel*≥2.6.38  –  <4.19.276
linuxlinux_kernel*≥4.20  –  <5.4.235
linuxlinux_kernel*≥5.5  –  <5.10.173
linuxlinux_kernel*≥5.11  –  <5.15.99
linuxlinux_kernel*≥5.16  –  <6.1.16
linuxlinux_kernel*≥6.2  –  <6.2.3

References 7

  • git.kernel.org https://git.kernel.org/stable/c/0af54343a76263a12dbae7fafb64eb47c4a6ad38
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3fc6401fafde11712a83089fa2cc874cfd10e2cd
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/61490d2710277e8a55009b7682456ae22f8087cf
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9acdec72787af1bc8ed92711b52118c8e3e638a2
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c766e37fccd5a5c5059be7efcd9618bf8a2c17c3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cd8316767099920a5d41feed1afab0c482a43e9f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f26dd69f61eff2eedf5df2d199bdd23108309947
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/0af54343a76263a12dbae7fafb64eb47c4a6ad38
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3fc6401fafde11712a83089fa2cc874cfd10e2cd
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/61490d2710277e8a55009b7682456ae22f8087cf
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9acdec72787af1bc8ed92711b52118c8e3e638a2
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c766e37fccd5a5c5059be7efcd9618bf8a2c17c3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cd8316767099920a5d41feed1afab0c482a43e9f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f26dd69f61eff2eedf5df2d199bdd23108309947
    Patch