Bug 2395305 (CVE-2023-53199)

Summary:	CVE-2023-53199 kernel: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	This is a denial-of-service bug in the HSR handling path: a crafted or malformed HSR frame may corrupt SKB metadata and lead to an skb_under_panic / kernel BUG. It requires the host to be able to deliver HSR frames to the victim (same L2 / bridge/HSR topology). This is not a universal network hole — it only affects systems using the HSR stack/driver (CONFIG_HSR / net/hsr). The bug causes a kernel panic (availability impact) by corrupting skb header/tags and hitting an skb_push()/skb_panic path. There is no indication of arbitrary memory write or control over instruction flow, so remote code execution or reliable memory corruption for privilege escalation is unlikely.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-09-15 15:06:33 UTC

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails

Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream().
While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated
skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we
have an incorrect pkt_len or pkt_tag, the input skb is considered invalid
and dropped. All the associated packets already in skb_pool should be
dropped and freed. Added a comment describing this issue.

The patch also makes remain_skb NULL after being processed so that it
cannot be referenced after potential free. The initialization of hif_dev
fields which are associated with remain_skb (rx_remain_len,
rx_transfer_len and rx_pad_len) is moved after a new remain_skb is
allocated.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Comment 1 Keith Grant 2025-09-16 13:08:15 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025091509-CVE-2023-53199-8a8c@gregkh/T