CVE-2023-53767: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53767 is a memory leak vulnerability in the Linux kernel's ath12k Wi-Fi driver, specifically within the ath12k_qmi_driver_event_work() function. When the ATH12K_FLAG_UNREGISTERING bit is set, the buffer pointed to by the event variable is not freed, resulting in a memory leak that can lead to denial of service. The vulnerability affects Linux kernel versions prior to 6.3.4 and 6.4, particularly on systems using Qualcomm QCN9274 hw2.0 PCI WLAN hardware. It was published on December 8, 2025, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing memory deallocation path (CWE-401: Missing Release of Memory after Effective Lifetime) in the ath12k_qmi_driver_event_work() function of the Linux kernel's ath12k Wi-Fi driver. When the ATH12K_FLAG_UNREGISTERING flag is set, the function returns early without freeing the event buffer or iterating through and freeing list entries, causing a cumulative memory leak. The fix replaces the early return with a goto skip statement to ensure proper cleanup of the event buffer and all associated list entries. Exploitation requires local access with low-privilege permissions (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation allows a local, low-privileged attacker to gradually exhaust system memory, potentially causing a denial of service condition on affected systems. The vulnerability has no impact on confidentiality or integrity — only availability is affected. Systems most at risk are those running the ath12k Wi-Fi driver with Qualcomm QCN9274 hw2.0 PCI WLAN hardware (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, further limiting the practical attack surface (Red Hat Advisory).

Patches are available for Linux kernel versions 6.3.4 and 6.4, addressing the missing memory deallocation in ath12k_qmi_driver_event_work(). Administrators should update to a patched kernel version as the primary remediation. As interim measures, restricting local user access on systems with ath12k Wi-Fi hardware and monitoring system memory usage can help reduce risk (Red Hat Advisory, Red Hat Bugzilla).