CVE-2023-53721 wifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan()
A NULL pointer dereference in the ath12k WiFi driver can cause a system crash, requiring a kernel patch to prevent denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53721?
CVE-2023-53721 is a vulnerability in Linux, published on 22 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan()
In ath12k_mac_op_hw_scan(), the return value of kzalloc() is directly used in memcpy(), which may lead to a NULL pointer dereference on failure of kzalloc().
Fix this bug by adding a check of arg.extraie.ptr.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4
Which versions are affected by CVE-2023-53721?
How do I fix CVE-2023-53721?
Apply the vendor's patch.
Is CVE-2023-53721 being exploited?
There is no known exploitation of CVE-2023-53721 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-53721, DEBIAN-CVE-2023-53721, GHSA-hg4j-jx55-3m9p, ROOT-OS-DEBIAN-11-CVE-2023-53721, ROOT-OS-DEBIAN-12-CVE-2023-53721, ROOT-OS-UBUNTU-2204-CVE-2023-53721 and 1 more.