In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()

Fix a stack-out-of-bounds write that occurs in a WMI response callback
function that is called after a timeout occurs in ath9k_wmi_cmd().
The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that
could no longer be valid when a timeout occurs. Set wmi->last_seq_id to
0 when a timeout occurred.

Found by a modified version of syzkaller.

BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx
Write of size 4
Call Trace:
memcpy
ath9k_wmi_ctrl_rx
ath9k_htc_rx_msg
ath9k_hif_usb_reg_in_cb
__usb_hcd_giveback_urb
usb_hcd_giveback_urb
dummy_timer
call_timer_fn
run_timer_softirq
__do_softirq
irq_exit_rcu
sysvec_apic_timer_interrupt

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00047.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
fb9987d0f748c983bb795a86f47522313f701a08 affected < 89a33c3c847b19b19205cde1d924df2a6c70d8eb
fb9987d0f748c983bb795a86f47522313f701a08 affected < ae4933b4f17de8e2b7ff6f91b17d3b0099a6d6bc
fb9987d0f748c983bb795a86f47522313f701a08 affected < bf6dc175a2b53098a69db1236d9d53982f4b1bc0
fb9987d0f748c983bb795a86f47522313f701a08 affected < 78b56b0a613a87b61290b95be497fdfe2fe58aa6
fb9987d0f748c983bb795a86f47522313f701a08 affected < 1af7eacfad45149c54893a8a9df9e92ef89f0a90
fb9987d0f748c983bb795a86f47522313f701a08 affected < 8f28513d9520184059530c01a9f928a1b3809d3f
fb9987d0f748c983bb795a86f47522313f701a08 affected < 554048a72d7ecfdd58cc1bfb56e0a1864e64e82c
fb9987d0f748c983bb795a86f47522313f701a08 affected < 8a2f35b9830692f7a616f2f627f943bc748af13a
Linux Linux affected
Version Status Constraints
2.6.35 affected —
0 unaffected < 2.6.35
4.14.308 unaffected ≤ 4.14.*
4.19.276 unaffected ≤ 4.19.*
5.4.235 unaffected ≤ 5.4.*
5.10.173 unaffected ≤ 5.10.*
5.15.99 unaffected ≤ 5.15.*
6.1.16 unaffected ≤ 6.1.*
6.2.3 unaffected ≤ 6.2.*
6.3 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/1af7eacfad45149c54893a8a9df9e92ef89f0a90 cve-icon cve-icon
https://git.kernel.org/stable/c/554048a72d7ecfdd58cc1bfb56e0a1864e64e82c cve-icon cve-icon
https://git.kernel.org/stable/c/78b56b0a613a87b61290b95be497fdfe2fe58aa6 cve-icon cve-icon
https://git.kernel.org/stable/c/89a33c3c847b19b19205cde1d924df2a6c70d8eb cve-icon cve-icon
https://git.kernel.org/stable/c/8a2f35b9830692f7a616f2f627f943bc748af13a cve-icon cve-icon
https://git.kernel.org/stable/c/8f28513d9520184059530c01a9f928a1b3809d3f cve-icon cve-icon
https://git.kernel.org/stable/c/ae4933b4f17de8e2b7ff6f91b17d3b0099a6d6bc cve-icon cve-icon
https://git.kernel.org/stable/c/bf6dc175a2b53098a69db1236d9d53982f4b1bc0 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025102214-CVE-2023-53717-e88c@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-53717 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-53717 cve-icon
History

Thu, 23 Oct 2025 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Thu, 23 Oct 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Wed, 22 Oct 2025 13:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() Fix a stack-out-of-bounds write that occurs in a WMI response callback function that is called after a timeout occurs in ath9k_wmi_cmd(). The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that could no longer be valid when a timeout occurs. Set wmi->last_seq_id to 0 when a timeout occurred. Found by a modified version of syzkaller. BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx Write of size 4 Call Trace: memcpy ath9k_wmi_ctrl_rx ath9k_htc_rx_msg ath9k_hif_usb_reg_in_cb __usb_hcd_giveback_urb usb_hcd_giveback_urb dummy_timer call_timer_fn run_timer_softirq __do_softirq irq_exit_rcu sysvec_apic_timer_interrupt
Title wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-10-22T13:23:50.161Z

Reserved: 2025-10-22T13:21:37.347Z

Link: CVE-2023-53717

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-10-22T14:15:46.367

Modified: 2025-10-22T21:12:48.953

Link: CVE-2023-53717

cve-icon Redhat

Severity : Important

Publid Date: 2025-10-22T00:00:00Z

Links: CVE-2023-53717 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2025-10-23T10:05:04Z

Weaknesses

No weakness.