CVE-2023-53721: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53721 is a NULL pointer dereference vulnerability in the Linux kernel's ath12k WiFi driver, specifically within the ath12k_mac_op_hw_scan() function. The flaw affects Linux kernel versions prior to the fixes introduced in 6.5.5 and 6.6. It was published on October 22, 2025, with patches available for the stable kernel tree. The vulnerability carries a CVSS v3.1 base score of 7.0 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper handling of a failed memory allocation (CWE-476: NULL Pointer Dereference). In ath12k_mac_op_hw_scan(), the return value of kzalloc() is passed directly to memcpy() without first checking whether the allocation succeeded. If kzalloc() returns NULL due to memory pressure or other conditions, the subsequent memcpy() operation dereferences a NULL pointer, triggering a kernel panic. The fix adds a validation check on arg.extraie.ptr before proceeding with the memory copy. The vulnerability was tested on WCN7850 hw2.0 PCI hardware (Red Hat Bugzilla, Kernel Patch 1).

Successful exploitation can cause a kernel NULL pointer dereference, resulting in a kernel panic or system crash, leading to a denial of service condition. Because the vulnerability resides in the WiFi driver subsystem, it can disrupt both system availability and network connectivity on affected WiFi-enabled devices. A local attacker with low privileges could trigger this condition, and the CVSS score reflects potential high impacts on confidentiality, integrity, and availability in a successful exploitation scenario (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges and has high attack complexity, limiting its practical exploitability. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory).

The primary remediation is to update to a patched Linux kernel version — fixes are available in kernel 6.5.5 and 6.6 and later. The patches add a NULL check on arg.extraie.ptr before the memcpy() call in ath12k_mac_op_hw_scan(). For systems that cannot be immediately patched, administrators should restrict local user access, monitor for unusual WiFi scanning activity, and consider temporarily disabling WiFi scanning if it is not operationally critical (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).