CVE-2023-53602: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53602 is a memory leak vulnerability discovered in the Linux kernel's ath11k WiFi driver. The issue affects the firmware statistics handling where memory allocated for firmware pdev, vdev and beacon statistics is not properly released during module removal (Debian Tracker).

The vulnerability occurs in the WiFi subsystem of the Linux kernel, specifically in the ath11k driver. The issue stems from a failure to call the ath11kfwstatsfree() function before hardware unregister during module removal. Additionally, there was an improper handling of firmware statistics during WMI event processing, where the local list gets spliced and reinitialized, leaving no elements in the list after splicing. This was confirmed on QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPLSILICONZ-1 hardware (Debian Tracker).

The vulnerability results in memory leaks when the ath11k module is unloaded, which could potentially lead to system resource depletion over time. This affects various Linux distributions including Debian bullseye, bookworm, trixie, and sid versions (Debian Tracker).

The issue has been fixed in various Linux kernel versions: Debian bookworm (6.1.52-1), Debian trixie (6.12.43-1), and Debian forky/sid (6.16.9-1). The fix involves properly calling the ath11kfwstats_free() function before hardware unregister and correcting the firmware statistics processing in WMI events (Debian Tracker).