CVE-2023-53570 wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()
A local attacker with CAP_NET_ADMIN can trigger an integer overflow leading to heap buffer overflow in the Linux kernel Wi-Fi subsystem, potentially enabling code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53570?
CVE-2023-53570 is a high-severity vulnerability in Linux kernel, published on 4 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()
nl80211_parse_mbssid_elems() uses a u8 variable num_elems to count the number of MBSSID elements in the nested netlink attribute attrs, which can lead to an integer overflow if a user of the nl80211 interface specifies 256 or more elements in the corresponding attribute in userspace. The integer overflow can lead to a heap buffer overflow as num_elems determines the size of the trailing array in elems, and this array is thereafter written to for each element in attrs.
Note that this vulnerability only affects devices with the wiphy->mbssid_max_interfaces member set for the wireless physical device struct in the device driver, and can only be triggered by a process with CAP_NET_ADMIN capabilities.
Fix this by checking for a maximum of 255 elements in attrs.
Weakness: CWE-190
Which versions are affected by CVE-2023-53570?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53570?
Apply the vendor's patch.
Is CVE-2023-53570 being exploited?
There is no known exploitation of CVE-2023-53570 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-53570, DEBIAN-CVE-2023-53570, GHSA-h96f-j67j-7f7q, UBUNTU-CVE-2023-53570.