CVE-2023-53199 wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
A memory leak in the ath9k USB WiFi driver allows attackers to cause a denial of service by triggering packet processing failures.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53199?
CVE-2023-53199 is a medium-severity denial of service vulnerability in Linux kernel, published on 15 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream(). While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we have an incorrect pkt_len or pkt_tag, the input skb is considered invalid and dropped. All the associated packets already in skb_pool should be dropped and freed. Added a comment describing this issue.
The patch also makes remain_skb NULL after being processed so that it cannot be referenced after potential free. The initialization of hif_dev fields which are associated with remain_skb (rx_remain_len, rx_transfer_len and rx_pad_len) is moved after a new remain_skb is allocated.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Weakness: CWE-772
Which versions are affected by CVE-2023-53199?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53199?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-53199 being exploited?
There is no known exploitation of CVE-2023-53199 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-53199, DEBIAN-CVE-2023-53199, GHSA-7774-rxjc-cwmm, UBUNTU-CVE-2023-53199.