---
id: CVE-2023-53199
title: 'wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails

  Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream().
  While processing skbs in …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 <
    3fc6401fafde11712a83089fa2cc874cfd10e2cd
  - >-
    Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 <
    cd8316767099920a5d41feed1afab0c482a43e9f
  - >-
    Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 <
    f26dd69f61eff2eedf5df2d199bdd23108309947
  - >-
    Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 <
    61490d2710277e8a55009b7682456ae22f8087cf
  - >-
    Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 <
    9acdec72787af1bc8ed92711b52118c8e3e638a2
  - >-
    Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 <
    c766e37fccd5a5c5059be7efcd9618bf8a2c17c3
  - >-
    Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 <
    0af54343a76263a12dbae7fafb64eb47c4a6ad38
  - Linux 2.6.38
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:20:12.413802Z'
published: '2025-09-15'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:21:07.183Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53199'
references:
  - url: 'https://git.kernel.org/stable/c/3fc6401fafde11712a83089fa2cc874cfd10e2cd'
  - url: 'https://git.kernel.org/stable/c/cd8316767099920a5d41feed1afab0c482a43e9f'
  - url: 'https://git.kernel.org/stable/c/f26dd69f61eff2eedf5df2d199bdd23108309947'
  - url: 'https://git.kernel.org/stable/c/61490d2710277e8a55009b7682456ae22f8087cf'
  - url: 'https://git.kernel.org/stable/c/9acdec72787af1bc8ed92711b52118c8e3e638a2'
  - url: 'https://git.kernel.org/stable/c/c766e37fccd5a5c5059be7efcd9618bf8a2c17c3'
  - url: 'https://git.kernel.org/stable/c/0af54343a76263a12dbae7fafb64eb47c4a6ad38'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.05149
ingestedAt: '2026-11-05T22:38:31.785Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails

Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream().
While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated
skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we
have an incorrect pkt_len or pkt_tag, the input skb is considered invalid
and dropped. All the associated packets already in skb_pool should be
dropped and freed. Added a comment describing this issue.

The patch also makes remain_skb NULL after being processed so that it
cannot be referenced after potential free. The initialization of hif_dev
fields which are associated with remain_skb (rx_remain_len,
rx_transfer_len and rx_pad_len) is moved after a new remain_skb is
allocated.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

## Affected

- `Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 3fc6401fafde11712a83089fa2cc874cfd10e2cd`
- `Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < cd8316767099920a5d41feed1afab0c482a43e9f`
- `Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < f26dd69f61eff2eedf5df2d199bdd23108309947`
- `Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 61490d2710277e8a55009b7682456ae22f8087cf`
- `Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 9acdec72787af1bc8ed92711b52118c8e3e638a2`
- `Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < c766e37fccd5a5c5059be7efcd9618bf8a2c17c3`
- `Linux >= 44b23b488d44e56d467764ecb661830e5b02b308 < 0af54343a76263a12dbae7fafb64eb47c4a6ad38`
- `Linux 2.6.38`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.