{"id":"CVE-2023-53199","title":"wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails\n\nSyzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream().\nWhile processing skbs in …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 3fc6401fafde11712a83089fa2cc874cfd10e2cd","Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < cd8316767099920a5d41feed1afab0c482a43e9f","Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < f26dd69f61eff2eedf5df2d199bdd23108309947","Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 61490d2710277e8a55009b7682456ae22f8087cf","Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 9acdec72787af1bc8ed92711b52118c8e3e638a2","Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < c766e37fccd5a5c5059be7efcd9618bf8a2c17c3","Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 0af54343a76263a12dbae7fafb64eb47c4a6ad38","Linux 2.6.38"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:20:12.413802Z"},"published":"2025-09-15","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:21:07.183Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-53199","references":[{"url":"https://git.kernel.org/stable/c/3fc6401fafde11712a83089fa2cc874cfd10e2cd"},{"url":"https://git.kernel.org/stable/c/cd8316767099920a5d41feed1afab0c482a43e9f"},{"url":"https://git.kernel.org/stable/c/f26dd69f61eff2eedf5df2d199bdd23108309947"},{"url":"https://git.kernel.org/stable/c/61490d2710277e8a55009b7682456ae22f8087cf"},{"url":"https://git.kernel.org/stable/c/9acdec72787af1bc8ed92711b52118c8e3e638a2"},{"url":"https://git.kernel.org/stable/c/c766e37fccd5a5c5059be7efcd9618bf8a2c17c3"},{"url":"https://git.kernel.org/stable/c/0af54343a76263a12dbae7fafb64eb47c4a6ad38"}],"tags":["cve.org"],"epss":0.0016,"epssPercentile":0.05149,"ingestedAt":"2026-11-05T22:38:31.785Z","slug":"CVE-2023-53199","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails\n\nSyzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream().\nWhile processing skbs in ath9k_hif_usb_rx_stream(), the already allocated\nskbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we\nhave an incorrect pkt_len or pkt_tag, the input skb is considered invalid\nand dropped. All the associated packets already in skb_pool should be\ndropped and freed. Added a comment describing this issue.\n\nThe patch also makes remain_skb NULL after being processed so that it\ncannot be referenced after potential free. The initialization of hif_dev\nfields which are associated with remain_skb (rx_remain_len,\nrx_transfer_len and rx_pad_len) is moved after a new remain_skb is\nallocated.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.\n\n## Affected\n\n- `Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 3fc6401fafde11712a83089fa2cc874cfd10e2cd`\n- `Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < cd8316767099920a5d41feed1afab0c482a43e9f`\n- `Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < f26dd69f61eff2eedf5df2d199bdd23108309947`\n- `Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 61490d2710277e8a55009b7682456ae22f8087cf`\n- `Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 9acdec72787af1bc8ed92711b52118c8e3e638a2`\n- `Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < c766e37fccd5a5c5059be7efcd9618bf8a2c17c3`\n- `Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 0af54343a76263a12dbae7fafb64eb47c4a6ad38`\n- `Linux 2.6.38`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}