{"cve":"CVE-2023-54300","nvd":{"published":"2025-12-30T13:16:19.120","modified":"2026-06-17T06:47:11.053","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx\n\nFor the reasons also described in commit b383e8abed41 (\"wifi: ath9k: avoid\nuninit memory read in ath9k_htc_rx_msg()\"), ath9k_htc_rx_msg() should\nvalidate pkt_len before accessing the SKB.\n\nFor example, the obtained SKB may have been badly constructed with\npkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr\nbut after being processed in ath9k_htc_rx_msg() and passed to\nath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI\ncommand header which should be located inside its data payload.\n\nImplement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit\nmemory can be referenced.\n\nTested on Qualcomm Atheros Communications AR9271 802.11n .\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/0bc12e41af4e3ae1f0efecc377f0514459df0707","https://git.kernel.org/stable/c/250efb4d3f5b32a115ea6bf25437ba44a1b3c04f","https://git.kernel.org/stable/c/28259ce4f1f1f9ab37fa817756c89098213d2fc0","https://git.kernel.org/stable/c/75acec91aeaa07375cd5f418069e61b16d39bbad","https://git.kernel.org/stable/c/8ed572e52714593b209e3aa352406aff84481179"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:18:08.089039631+00:00"},"epss":{"cve":"CVE-2023-54300","score":0.00234,"percentile":0.14327,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}