LiveActive security incident?Get immediate response
CVE Record

CVE-2023-52594: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() Fix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug occurs when txs->cnt, data from a URB provided by a USB device, is bigger than the size of the array txs->txstatus, which is HTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug handling code after the check. Make the function return if that is the case. Found by a modified version of syzkaller. UBSAN: array-index-out-of-bounds in htc_drv_txrx.c index 13 is out of range for type '__wmi_event_txstatus [12]' Call Trace: ath9k_htc_txstatus ath9k_wmi_event_tasklet tasklet_action_common __do_softirq irq_exit_rxu sysvec_apic_timer_interrupt

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-52594 is a Linux kernel bug in the ath9k_htc USB Wi-Fi driver. A USB Wi-Fi device can provide more transmit status entries than the driver array holds, causing an out-of-bounds read. Business impact is mainly systems using affected Atheros USB Wi-Fi hardware and unpatched kernels.

Executive priority

Treat as a targeted kernel maintenance item, not an emergency, unless the organization relies on USB Wi-Fi adapters in exposed or unmanaged environments. Prioritize patching affected endpoints and appliances during normal security update cycles.

Technical view

ath9k_htc_txstatus() trusted txs->cnt from a URB supplied by a USB device. When cnt exceeded HTC_MAX_TX_STATUS, WARN_ON() triggered but execution continued, allowing reads beyond txs->txstatus. The kernel fix returns early when the count is too large. The issue was found with a modified syzkaller.

Likely exposure

Exposure is likely limited to Linux systems using the ath9k_htc USB Wi-Fi driver with affected kernel versions or vendor kernels lacking the stable fix. Servers without this driver or hardware are unlikely to be exposed.

Exploitation context

The source bundle does not show KEV listing, active exploitation, public weaponization, or a CVSS score. The described trigger involves malformed data from a USB device, so practical exposure depends on device access and driver use.

Researcher notes

The record lacks CVSS, CWE, and full downstream package status. The core fix is defensive bounds handling after an existing warning check. Avoid broad Linux exposure claims; validate actual ath9k_htc driver presence and vendor backport state.

Mitigation direction

  • Update to a vendor or stable Linux kernel containing the ath9k_htc fix.
  • Apply relevant distribution security updates, including Debian LTS updates where applicable.
  • Remove or disable affected ath9k_htc USB Wi-Fi devices if patching is delayed.
  • Monitor kernel and distribution advisories for backport status.

Validation and detection

  • Inventory Linux hosts using ath9k_htc or Atheros USB Wi-Fi adapters.
  • Compare running kernel packages against vendor advisories and stable fix backports.
  • Check kernel logs for ath9k_htc UBSAN or array-index warnings.
  • Confirm patched kernels remain deployed after reboot.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-52594 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
11Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux27876a29de221186c9d5883e5fe5f6da18ef9a45, 27876a29de221186c9d5883e5fe5f6da18ef9a45, 27876a29de221186c9d5883e5fe5f6da18ef9a45, 27876a29de221186c9d5883e5fe5f6da18ef9a45, 27876a29de221186c9d5883e5fe5f6da18ef9a45, 27876a29de221186c9d5883e5fe5f6da18ef9a45, 27876a29de221186c9d5883e5fe5f6da18ef9a45, 27876a29de221186c9d5883e5fe5f6da18ef9a45unaffected
LinuxLinux3.0, 0, 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.