CVE-2023-53802: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53802 is a memory leak vulnerability in the Linux kernel's ath9k Wi-Fi driver, specifically in the ath9k_htc_rx_msg() function within the HTC host transport layer (htc_hst). The flaw occurs because the function fails to free the socket buffer (skb) when no callback function is registered to handle it, contrary to its documented contract. It affects the Linux kernel from version 2.6.35 onward, with patches backported to stable branches including 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3. The vulnerability was discovered by the Linux Verification Center (linuxtesting.org) using the Syzkaller fuzzer and published on December 9, 2025. The CVSS estimate is Medium severity, with an EPSS score of 0.024% (Feedly, EUVD).

The root cause is a missing kfree_skb() call in ath9k_htc_rx_msg() (CWE-401: Missing Release of Memory after Effective Lifetime). The function is designed to either free the provided skb or delegate its lifecycle to a registered callback; however, when no callback is present for a given endpoint type, the code path exits without releasing the buffer, causing a kernel memory leak. This flaw is reachable via the ath9k HTC (Host Target Communication) receive path, which processes incoming Wi-Fi frames from USB-attached ath9k HTC devices. Exploitation requires local access or the ability to influence Wi-Fi frame reception on a system with an affected ath9k HTC adapter (Feedly, EUVD).

The primary impact is a kernel memory leak, which can gradually exhaust available kernel memory on systems using ath9k HTC-based Wi-Fi adapters (typically USB Wi-Fi dongles). Sustained exploitation could degrade system performance and potentially lead to a denial-of-service condition as kernel memory is depleted. There is no evidence of confidentiality or integrity impact; the vulnerability does not enable code execution or privilege escalation (Feedly, EUVD).

No public exploit code or in-the-wild exploitation has been reported for CVE-2023-53802. The EPSS score is approximately 0.024%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require either local access to a system with an ath9k HTC Wi-Fi device or the ability to send crafted Wi-Fi frames to trigger the affected code path (Feedly).

Apply the upstream Linux kernel patches that add the missing kfree_skb() call in ath9k_htc_rx_msg(). Fixed versions are available in the following stable branches: 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3. Users should update to a patched kernel version provided by their Linux distribution. As a workaround, systems that do not use ath9k HTC-based (USB) Wi-Fi adapters are not affected and require no action (EUVD, Feedly).