Not yet scoredPublished Dec 30, 2025

CVE-2023-54300wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx

Updated under an hour ago (Oct 28, 2026, 2:10 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should validate pkt_len before accessing the SKB. For example, the obtained SKB may have been badly constructed with pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr but after being processed in ath9k_htc_rx_msg() and passed to ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI command header which should be located inside its data payload. Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit memory can be referenced. Tested on Qualcomm Atheros Communications AR9271 802.11n . Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from fb9987d0f748c983bb795a86f47522313f701a08 before 0bc12e41af4e3ae1f0efecc377f0514459df0707; from fb9987d0f748c983bb795a86f47522313f701a08 before 28259ce4f1f1f9ab37fa817756c89098213d2fc0; from fb9987d0f748c983bb795a86f47522313f701a08 before 90e3c10177573b8662ac9858abd9bf731d5d98e0; from fb9987d0f748c983bb795a86f47522313f701a08 before 250efb4d3f5b32a115ea6bf25437ba44a1b3c04f; from fb9987d0f748c983bb795a86f47522313f701a08 before ad5425e70789c29b93acafb5bb4629e4eb908296; from fb9987d0f748c983bb795a86f47522313f701a08 before d1c2ff2bd84c3692c9df267a2b991ce92bfca8ef; from fb9987d0f748c983bb795a86f47522313f701a08 before 8ed572e52714593b209e3aa352406aff84481179; from fb9987d0f748c983bb795a86f47522313f701a08 before 75acec91aeaa07375cd5f418069e61b16d39bbad; and 1 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/0bc12e41af4e3ae1f0efecc377f0514459df0707
https://git.kernel.org/stable/c/28259ce4f1f1f9ab37fa817756c89098213d2fc0
https://git.kernel.org/stable/c/90e3c10177573b8662ac9858abd9bf731d5d98e0
https://git.kernel.org/stable/c/250efb4d3f5b32a115ea6bf25437ba44a1b3c04f
https://git.kernel.org/stable/c/ad5425e70789c29b93acafb5bb4629e4eb908296
https://git.kernel.org/stable/c/d1c2ff2bd84c3692c9df267a2b991ce92bfca8ef
https://git.kernel.org/stable/c/8ed572e52714593b209e3aa352406aff84481179
https://git.kernel.org/stable/c/75acec91aeaa07375cd5f418069e61b16d39bbad
https://git.kernel.org/stable/c/f24292e827088bba8de7158501ac25a59b064953

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.