CVE-2023-53199None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream(). While processing skbs in …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream(). While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we have an incorrect pkt_len or pkt_tag, the input skb is considered invalid and dropped. All the associated packets already in skb_pool should be dropped and freed. Added a comment describing this issue.
The patch also makes remain_skb NULL after being processed so that it cannot be referenced after potential free. The initialization of hif_dev fields which are associated with remain_skb (rx_remain_len, rx_transfer_len and rx_pad_len) is moved after a new remain_skb is allocated.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 3fc6401fafde11712a83089fa2cc874cfd10e2cdLinux >= 44b23b488d44e56d467764ecb661830e5b02b308 < cd8316767099920a5d41feed1afab0c482a43e9fLinux >= 44b23b488d44e56d467764ecb661830e5b02b308 < f26dd69f61eff2eedf5df2d199bdd23108309947Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 61490d2710277e8a55009b7682456ae22f8087cfLinux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 9acdec72787af1bc8ed92711b52118c8e3e638a2Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < c766e37fccd5a5c5059be7efcd9618bf8a2c17c3Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 0af54343a76263a12dbae7fafb64eb47c4a6ad38Linux 2.6.38Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses