CVE-2023-54300
published 2025-12-30CVE-2023-54300: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx For the reasons also…
PriorityP422medium6.6
EPSS
0.20%
10.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid
uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should
validate pkt_len before accessing the SKB.
For example, the obtained SKB may have been badly constructed with
pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr
but after being processed in ath9k_htc_rx_msg() and passed to
ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI
command header which should be located inside its data payload.
Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit
memory can be referenced.
Tested on Qualcomm Atheros Communications AR9271 802.11n .
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.52-1 (bookworm) | linux 6.1.52-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 0bc12e41af4e3ae1f0efecc377f0514459df0707 | 0bc12e41af4e3ae1f0efecc377f0514459df0707 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 28259ce4f1f1f9ab37fa817756c89098213d2fc0 | 28259ce4f1f1f9ab37fa817756c89098213d2fc0 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 90e3c10177573b8662ac9858abd9bf731d5d98e0 | 90e3c10177573b8662ac9858abd9bf731d5d98e0 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 250efb4d3f5b32a115ea6bf25437ba44a1b3c04f | 250efb4d3f5b32a115ea6bf25437ba44a1b3c04f |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < ad5425e70789c29b93acafb5bb4629e4eb908296 | ad5425e70789c29b93acafb5bb4629e4eb908296 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < d1c2ff2bd84c3692c9df267a2b991ce92bfca8ef | d1c2ff2bd84c3692c9df267a2b991ce92bfca8ef |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 8ed572e52714593b209e3aa352406aff84481179 | 8ed572e52714593b209e3aa352406aff84481179 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 75acec91aeaa07375cd5f418069e61b16d39bbad | 75acec91aeaa07375cd5f418069e61b16d39bbad |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < f24292e827088bba8de7158501ac25a59b064953 | f24292e827088bba8de7158501ac25a59b064953 |
| linux | linux_kernel | >= 0 < 5.10.191-1 | 5.10.191-1 |
| linux | linux_kernel | >= 0 < 6.1.52-1 | 6.1.52-1 |
| linux | linux_kernel | >= 0 < 6.4.4-1 | 6.4.4-1 |
| linux | linux_kernel | >= 0 < 6.4.4-1 | 6.4.4-1 |
| linux | linux_kernel | >= 2.6.35 < 4.14.322 | 4.14.322 |
| linux | linux_kernel | >= 4.15.0 < 4.19.291 | 4.19.291 |
| linux | linux_kernel | >= 4.20.0 < 5.4.251 | 5.4.251 |
| linux | linux_kernel | >= 5.11.0 < 5.15.121 | 5.15.121 |
| linux | linux_kernel | >= 5.16.0 < 6.1.39 | 6.1.39 |
| linux | linux_kernel | >= 5.5.0 < 5.10.188 | 5.10.188 |
| linux | linux_kernel | >= 6.2.0 < 6.3.13 | 6.3.13 |
| linux | linux_kernel | >= 6.4.0 < 6.4.4 | 6.4.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
osv·2025-12-30
CVE-2023-54300 wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid
uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should
validate pkt_len before accessing the SKB.
For example, the obtained SKB may have been badly constructed with
pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr
but after being processed in ath9k_htc_rx_msg() and passed to
ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI
command header which should be located inside its data payload.
Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, unini
GHSA
GHSA-2337-fj37-r35q: In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
For the reason
ghsa_unreviewed·2025-12-30
CVE-2023-54300 GHSA-2337-fj37-r35q: In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
For the reason
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid
uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should
validate pkt_len before accessing the SKB.
For example, the obtained SKB may have been badly constructed with
pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr
but after being processed in ath9k_htc_rx_msg() and passed to
ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI
command header which should be located inside its data payload.
Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit
memory can be referenced.
Tested on Qualcomm Atheros Communicati
OSV
CVE-2023-54300: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx For the reasons
osv·2025-12-30
CVE-2023-54300 CVE-2023-54300: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx For the reasons
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should validate pkt_len before accessing the SKB. For example, the obtained SKB may have been badly constructed with pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr but after being processed in ath9k_htc_rx_msg() and passed to ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI command header which should be located inside its data payload. Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit memory can be referenced. Tested on Qualcomm Atheros Communications A
Red Hat
kernel: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
vendor_redhat·2025-12-30·CVSS 6.6
CVE-2023-54300 [MEDIUM] CWE-824 kernel: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
kernel: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid
uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should
validate pkt_len before accessing the SKB.
For example, the obtained SKB may have been badly constructed with
pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr
but after being processed in ath9k_htc_rx_msg() and passed to
ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI
command header which should be located inside its data payload.
Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, u
Debian
CVE-2023-54300: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k...
vendor_debian·2023
CVE-2023-54300 CVE-2023-54300: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k...
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should validate pkt_len before accessing the SKB. For example, the obtained SKB may have been badly constructed with pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr but after being processed in ath9k_htc_rx_msg() and passed to ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI command header which should be located inside its data payload. Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit memory can be referenced. Tested on Qualcomm Atheros Communications A
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-54300 kernel: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
bugzilla·2025-12-30
CVE-2023-54300 [MEDIUM] CVE-2023-54300 kernel: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
CVE-2023-54300 kernel: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid
uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should
validate pkt_len before accessing the SKB.
For example, the obtained SKB may have been badly constructed with
pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr
but after being processed in ath9k_htc_rx_msg() and passed to
ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI
command header which should be located inside its data payload.
Implement sanity checking inside ath9k_wmi_ctrl
Wiz
CVE-2023-54300 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2023-54300 CVE-2023-54300 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2023-54300 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid
uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should
validate pkt_len before accessing the SKB.
For example, the obtained SKB may have been badly constructed with
pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr
but after being processed in ath9k_htc_rx_msg() and passed to
ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI
command header which should be located inside its data payload.
Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise,
https://git.kernel.org/stable/c/0bc12e41af4e3ae1f0efecc377f0514459df0707https://git.kernel.org/stable/c/250efb4d3f5b32a115ea6bf25437ba44a1b3c04fhttps://git.kernel.org/stable/c/28259ce4f1f1f9ab37fa817756c89098213d2fc0https://git.kernel.org/stable/c/75acec91aeaa07375cd5f418069e61b16d39bbadhttps://git.kernel.org/stable/c/8ed572e52714593b209e3aa352406aff84481179https://git.kernel.org/stable/c/90e3c10177573b8662ac9858abd9bf731d5d98e0https://git.kernel.org/stable/c/ad5425e70789c29b93acafb5bb4629e4eb908296https://git.kernel.org/stable/c/d1c2ff2bd84c3692c9df267a2b991ce92bfca8efhttps://git.kernel.org/stable/c/f24292e827088bba8de7158501ac25a59b064953
2025-12-30
Published