CVE-2023-54016: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54016 is a memory leak vulnerability in the Linux kernel's ath12k Wi-Fi driver, specifically within the ath12k_dp_cc_cleanup() function, which fails to free memory allocated for rx_descs and tx_descs during descriptor cleanup. The vulnerability affects Linux kernel versions from the initial commit (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2) up to the patched commits, with fixes backported to kernel 6.5.5 and 6.6. It was published on December 24, 2025, and is tested against Qualcomm QCN9274 hardware. No CVSS score has been assigned by NVD at this time, and the record is not prioritized for NVD enrichment (Feedly, CVE.org).

The root cause is a missing memory deallocation in the ath12k_dp_cc_cleanup() function of the Linux kernel's ath12k Wi-Fi driver (CWE classification not formally assigned by NVD). When ath12k_dp_cc_desc_init() is called, it allocates heap memory for rx_descs and tx_descs descriptor arrays, but the corresponding cleanup function ath12k_dp_cc_cleanup() does not free this memory, resulting in a kernel memory leak. The fix involves saving the base addresses of rx_descs and tx_descs in ath12k_dp_cc_desc_init() and using those base addresses to free the memory in ath12k_dp_cc_cleanup(). The vulnerability is local in nature and requires the affected Wi-Fi driver to be loaded and operational (Feedly, kernel.org patch 1, kernel.org patch 2).

The primary impact of this vulnerability is a kernel memory leak, which over time can degrade system stability and availability by exhausting kernel memory resources on systems using the ath12k Wi-Fi driver with affected Qualcomm hardware (e.g., QCN9274). There is no evidence of confidentiality or integrity impact, as the vulnerability does not expose sensitive data or allow unauthorized code execution. Prolonged exploitation or repeated triggering of the leak path could lead to system instability or denial of service on affected devices (Feedly).

The fix is available in Linux kernel versions 6.5.5 and 6.6, via commits afb522b36e76acaa9f8fc06d0a9742d841c47c16 and e16be2d34883eecfe7fd888fcdb76c7a5db5d187 respectively. Administrators running systems with Qualcomm ath12k-based Wi-Fi hardware (e.g., QCN9274) should update to a patched kernel version. SUSE has also released kernel updates addressing this CVE (SUSE-2026-0281-1 and SUSE-2026-20876-1) (kernel.org patch 1, kernel.org patch 2, Linux Security SUSE).