CVE-2023-53822: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53822 is a NULL pointer dereference vulnerability in the Linux kernel's ath11k Wi-Fi driver that can cause a kernel crash (denial of service). It affects the Linux kernel across versions from the initial commit up to (but not including) the patched releases: 6.1.30, 6.3.4, and 6.4. The vulnerability was published on December 9, 2025, and is estimated to be of medium severity with an EPSS score of approximately 0.017% (Feedly, ENISA EUVD).

The root cause is a missing initialization check (CWE-476: NULL Pointer Dereference) in the ath11k datapath receive path. When maximum virtual AP interfaces are configured across all bands with Automatic Channel Selection (ACS) and hostapd is restarted periodically, a fragmented packet can arrive for a "self peer" whose rx_tid and rx_frag structures have not yet been initialized in the datapath. When ath11k_dp_rx_h_sort_frags attempts to walk the uninitialized rx_frag list, a NULL skb pointer dereference triggers a kernel exception. The fix adds a check for the dp_setup_done flag before processing received fragments, ensuring the peer's datapath fragment queue setup is complete before any fragment handling occurs (Feedly, Kernel Patch 6.1).

Successful exploitation causes a kernel panic/crash on the affected system, resulting in a complete loss of availability (denial of service). The vulnerability is triggered in the network receive path, meaning a remote attacker on the same Wi-Fi network could potentially send crafted fragmented packets to crash the kernel of a device running a vulnerable ath11k-based Wi-Fi adapter (e.g., IPQ8074). There is no evidence of confidentiality or integrity impact beyond the system crash (Feedly).

The vulnerability is fixed in Linux kernel versions 6.1.30, 6.3.4, and 6.4. Users should update their Linux kernel to one of these patched versions or any later stable release. The specific upstream commits are available at the kernel stable repository for each affected branch (Kernel Patch 6.1, Kernel Patch 6.3, Kernel Patch 6.4). As a temporary workaround, avoiding the use of maximum virtual AP interfaces with ACS and frequent hostapd restarts on ath11k-based hardware may reduce the likelihood of triggering the crash.