CVE-2023-54286: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54286 is a buffer overflow vulnerability in the Linux kernel's iwlwifi DVM Wi-Fi driver, specifically in the iwlagn_send_sta_key() function in drivers/net/wireless/intel/iwlwifi/dvm/sta.c. The flaw arises when a received TKIP key (up to 32 bytes, including MIC rx/tx keys) is copied into the iwl_keyinfo.key field, which is only 16 bytes, causing a field-spanning write overflow. The vulnerability was published on December 30, 2025, and affects Linux kernel versions from the initial commit up through multiple stable branches. Feedly estimates the severity as Medium, with an EPSS score of 0.000240 (Feedly, ENISA EUVD).

The root cause is a classic buffer overflow (CWE-120) in the iwlagn_send_sta_key() function within the iwldvm kernel module. When the mac80211 subsystem installs a TKIP key via ieee80211_key_replace → ieee80211_key_enable_hw_accel → drv_set_key → iwlagn_mac_set_key → iwl_set_dynamic_key → iwlagn_send_sta_key, the full 32-byte TKIP key material (including MIC keys not used by the iwl hardware) is copied via memcpy into sta_cmd.key.key, which is only 16 bytes. The kernel's hardened memcpy detects this as a field-spanning write and emits a WARNING, but the overflow still occurs in unpatched kernels. The fix adds a bounds check to limit the copy to sizeof(sta_cmd.key.key) bytes (Feedly, ENISA EUVD).

The overflow writes beyond the iwl_keyinfo.key field into adjacent kernel memory, which could corrupt kernel data structures. In practice, the kernel's hardened memcpy generates a warning backtrace, potentially causing system instability or denial of service. The vulnerability is local in nature, triggered during Wi-Fi key installation on systems using Intel iwlwifi DVM-based adapters with TKIP encryption, and does not appear to directly enable remote code execution or privilege escalation based on available information (Feedly).

The Linux kernel project has released patches across multiple stable branches. Fixed versions include: 4.14.316, 4.19.284, 5.4.244, 5.10.181, 5.15.113, 6.1.30, 6.3.4, and 6.4+. Users should update their Linux kernel to one of these patched versions. As a workaround, avoiding TKIP encryption on systems with Intel iwlwifi DVM adapters (e.g., using WPA2/AES instead) would prevent the vulnerable code path from being triggered (ENISA EUVD, Feedly).