CVE-2023-54029: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54029 is a rejected/withdrawn CVE that was originally associated with a NULL pointer dereference vulnerability in the Linux kernel's iwlwifi Wi-Fi driver, specifically in the iwl_mvm_max_amsdu_size() function related to Multi-Link Operation (MLO) handling. The CVE was initially published on December 24, 2025, and subsequently rejected by its CVE Numbering Authority (kernel.org) on January 5, 2026. The original description indicated that using vif->bss_conf.chandef.chan->band in MLO contexts could lead to a NULL pointer dereference because bss_conf is not used in that scenario. No CVSS score was assigned by NVD, and the Feedly EPSS score is effectively 0.00017 (CVE Record).

Prior to rejection, the vulnerability was described as a NULL pointer dereference (consistent with CWE-476) in the Linux kernel's iwlwifi driver function iwl_mvm_max_amsdu_size(). The root cause was improper handling of the MLO (Multi-Link Operation) code path: the function attempted to access vif->bss_conf.chandef.chan->band, but in MLO mode bss_conf is not populated, resulting in a NULL dereference. Additionally, the fix noted that real MLO scenarios require accounting for both LMACs simultaneously if a station is active on both. Three kernel patch commits were originally referenced (for stable branches targeting Linux 6.1.30, 6.3.4, and 6.4) before being removed upon rejection (CVE Record).

Because this CVE has been officially rejected and withdrawn by its CVE Numbering Authority, no confirmed security impact should be attributed to this identifier. The original description suggested a potential NULL pointer dereference in the kernel Wi-Fi subsystem that could cause a kernel crash (denial of service), but this assessment was invalidated upon rejection. No confidentiality, integrity, or availability impact is formally associated with this CVE (CVE Record).

As CVE-2023-54029 has been officially rejected and withdrawn, no patches or workarounds are formally associated with this identifier. Organizations that previously tracked this CVE should remove it from their vulnerability management workflows. If the underlying iwlwifi MLO NULL dereference concern is relevant to your environment, consult the Linux kernel stable release notes for versions 6.1.30, 6.3.4, and 6.4 for any related fixes applied under a different identifier (CVE Record).