cbcvebase.
CVE-2023-53315
published 2025-09-16

CVE-2023-53315: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix SKB corruption in REO destination ring While running traffics for a long…

PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
12.0th percentile
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix SKB corruption in REO destination ring While running traffics for a long time, randomly an RX descriptor filled with value "0" from REO destination ring is received. This descriptor which is invalid causes the wrong SKB (SKB stored in the IDR lookup with buffer id "0") to be fetched which in turn causes SKB memory corruption issue and the same leads to crash after some time. Changed the start id for idr allocation to "1" and the buffer id "0" is reserved for error validation. Introduced Sanity check to validate the descriptor, before processing the SKB. Crash Signature : Unable to handle kernel paging request at virtual address 3f004900 PC points to "b15_dma_inv_range+0x30/0x50" LR points to "dma_cache_maint_page+0x8c/0x128". The Backtrace obtained is as follows: [] (b15_dma_inv_range) from [] (dma_cache_maint_page+0x8c/0x128) [] (dma_cache_maint_page) from [] (__dma_page_dev_to_cpu+0x28/0xcc) [] (__dma_page_dev_to_cpu) from [] (ath11k_dp_process_rx+0x1e8/0x4a4 [ath11k]) [] (ath11k_dp_process_rx [ath11k]) from [] (ath11k_dp_service_srng+0xb0/0x2ac [ath11k]) [] (ath11k_dp_service_srng [ath11k]) from [] (ath11k_pci_ext_grp_napi_poll+0x1c/0x78 [ath11k_pci]) [] (ath11k_pci_ext_grp_napi_poll [ath11k_pci]) from [] (__napi_poll+0x28/0xb8) [] (__napi_poll) from [] (net_rx_action+0xf0/0x280) [] (net_rx_action) from [] (__do_softirq+0xd0/0x280) [] (__do_softirq) from [] (irq_exit+0x74/0xd4) [] (irq_exit) from [] (__handle_domain_irq+0x90/0xb4) [] (__handle_domain_irq) from [] (gic_handle_irq+0x58/0x90) [] (gic_handle_irq) from [] (__irq_svc+0x58/0x8c) Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1

Affected

15 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.37-1 (bookworm)linux 6.1.37-1 (bookworm)
linuxlinux——
linuxlinux>= d5c65159f2895379e11ca13f62feabe93278985d < 866921dc06b94df91acfcf9359b57da943ed99b3866921dc06b94df91acfcf9359b57da943ed99b3
linuxlinux>= d5c65159f2895379e11ca13f62feabe93278985d < 3d3f8fe01a01d94a17fe1ae0d2e894049a9727173d3f8fe01a01d94a17fe1ae0d2e894049a972717
linuxlinux>= d5c65159f2895379e11ca13f62feabe93278985d < 068fd06148fbf0af95bb08dc77cff34ee679fdbc068fd06148fbf0af95bb08dc77cff34ee679fdbc
linuxlinux>= d5c65159f2895379e11ca13f62feabe93278985d < 67459491f78146bcf7d93596e5b709d063dff5d867459491f78146bcf7d93596e5b709d063dff5d8
linuxlinux>= d5c65159f2895379e11ca13f62feabe93278985d < f9fff67d2d7ca6fa8066132003a3deef654c55b1f9fff67d2d7ca6fa8066132003a3deef654c55b1
linuxlinux_kernel>= 0 < 5.10.191-15.10.191-1
linuxlinux_kernel>= 0 < 6.1.37-16.1.37-1
linuxlinux_kernel>= 0 < 6.3.7-16.3.7-1
linuxlinux_kernel>= 0 < 6.3.7-16.3.7-1
linuxlinux_kernel>= 5.11 < 5.15.1135.15.113
linuxlinux_kernel>= 5.16 < 6.1.306.1.30
linuxlinux_kernel>= 5.6 < 5.10.1815.10.181
linuxlinux_kernel>= 6.2 < 6.3.46.3.4

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.