CVE-2023-53721: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53721 is a vulnerability discovered in the Linux kernel affecting the ath12k WiFi driver. The issue was disclosed on October 22, 2025, and involves a NULL pointer dereference in the ath12k_mac_op_hw_scan() function. The vulnerability specifically affects the WCN7850 hardware component (NVD, RedHat).

The vulnerability occurs in the ath12k_mac_op_hw_scan() function where the return value of kzalloc() is directly used in memcpy() without proper validation. This can lead to a NULL pointer dereference if kzalloc() fails. The issue affects WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 hardware. According to Red Hat's assessment, this vulnerability has been assigned a CVSS v3.1 score of 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) (RedHat).

The vulnerability can lead to a system crash due to NULL pointer dereference when the memory allocation fails during WiFi scanning operations. This primarily affects systems using the ath12k WiFi driver with the specific WCN7850 hardware (NVD).

The issue has been fixed by adding a check of arg.extraie.ptr before using it in the memcpy operation. Users are advised to update their systems with the patched version of the kernel that includes this fix (NVD).