{"id":"CVE-2023-53641","title":"wifi: ath9k: hif_usb: fix memory leak of remain_skbs","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: hif_usb: fix memory leak of remain_skbs\n\nhif_dev->remain_skb is allocated and used exclusively in\nath9k_hif_usb_rx_stream(). It is implied that an allocate…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 6719e3797ec52cd144c8a5ba8aaab36674800585","Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < d9899318660791141ea6002fda5577b2c5d7386e","Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 320d760a35273aa815d58b57e4fd9ba5279a3489","Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 59073060fe0950c6ecbe12bdc06469dcac62128d","Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 9b9356a3014123f0ce4b50d9278c1265173150ab","Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < f0931fc8f4b6847c72e170d2326861c0a081d680","Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 8f02d538878c9b1501f624595eb22ee4e5e0ff84","Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 7654cc03eb699297130b693ec34e25f77b17c947","Linux 2.6.35"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:26:20.455760Z"},"published":"2025-10-07","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:31:19.142Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-53641","references":[{"url":"https://git.kernel.org/stable/c/6719e3797ec52cd144c8a5ba8aaab36674800585"},{"url":"https://git.kernel.org/stable/c/d9899318660791141ea6002fda5577b2c5d7386e"},{"url":"https://git.kernel.org/stable/c/320d760a35273aa815d58b57e4fd9ba5279a3489"},{"url":"https://git.kernel.org/stable/c/59073060fe0950c6ecbe12bdc06469dcac62128d"},{"url":"https://git.kernel.org/stable/c/9b9356a3014123f0ce4b50d9278c1265173150ab"},{"url":"https://git.kernel.org/stable/c/f0931fc8f4b6847c72e170d2326861c0a081d680"},{"url":"https://git.kernel.org/stable/c/8f02d538878c9b1501f624595eb22ee4e5e0ff84"},{"url":"https://git.kernel.org/stable/c/7654cc03eb699297130b693ec34e25f77b17c947"}],"tags":["cve.org"],"epss":0.0016,"epssPercentile":0.05158,"ingestedAt":"2026-11-05T22:38:31.821Z","slug":"CVE-2023-53641","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: hif_usb: fix memory leak of remain_skbs\n\nhif_dev->remain_skb is allocated and used exclusively in\nath9k_hif_usb_rx_stream(). It is implied that an allocated remain_skb is\nprocessed and subsequently freed (in error paths) only during the next\ncall of ath9k_hif_usb_rx_stream().\n\nSo, if the urbs are deallocated between those two calls due to the device\ndeinitialization or suspend, it is possible that ath9k_hif_usb_rx_stream()\nis not called next time and the allocated remain_skb is leaked. Our local\nSyzkaller instance was able to trigger that.\n\nremain_skb makes sense when receiving two consecutive urbs which are\nlogically linked together, i.e. a specific data field from the first skb\nindicates a cached skb to be allocated, memcpy'd with some data and\nsubsequently processed in the next call to ath9k_hif_usb_rx_stream(). Urbs\ndeallocation supposedly makes that link irrelevant so we need to free the\ncached skb in those cases.\n\nFix the leak by introducing a function to explicitly free remain_skb (if\nit is not NULL) when the rx urbs have been deallocated. remain_skb is NULL\nwhen it has not been allocated at all (hif_dev struct is kzalloced) or\nwhen it has been processed in next call to ath9k_hif_usb_rx_stream().\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.\n\n## Affected\n\n- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 6719e3797ec52cd144c8a5ba8aaab36674800585`\n- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < d9899318660791141ea6002fda5577b2c5d7386e`\n- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 320d760a35273aa815d58b57e4fd9ba5279a3489`\n- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 59073060fe0950c6ecbe12bdc06469dcac62128d`\n- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 9b9356a3014123f0ce4b50d9278c1265173150ab`\n- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < f0931fc8f4b6847c72e170d2326861c0a081d680`\n- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 8f02d538878c9b1501f624595eb22ee4e5e0ff84`\n- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 7654cc03eb699297130b693ec34e25f77b17c947`\n- `Linux 2.6.35`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}