LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53767: wifi: ath12k: fix memory leak in ath12k_qmi_driver_event_work()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k_qmi_driver_event_work() Currently the buffer pointed by event is not freed in case ATH12K_FLAG_UNREGISTERING bit is set, this causes memory leak. Add a goto skip instead of return, to ensure event and all the list entries are freed properly. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a memory leak in the ath12k Wi-Fi driver. When the driver is unregistering, allocated event data may not be freed. The business risk is mainly system stability or resource exhaustion on affected systems, not confirmed data theft or remote compromise.

Executive priority

Treat this as routine kernel maintenance unless affected Wi-Fi systems are business-critical or reliability-sensitive. There is no provided evidence of active exploitation, but unpatched memory leaks can still degrade availability over time.

Technical view

The flaw is in ath12k_qmi_driver_event_work(). If ATH12K_FLAG_UNREGISTERING is set, the code returned before freeing the event buffer and list entries. The upstream fix changes control flow so cleanup still happens. Sources identify Linux kernel versions around 6.3, 6.3.4, and 6.4, but severity metadata is incomplete.

Likely exposure

Exposure appears limited to Linux systems using the ath12k Wi-Fi driver, especially Qualcomm Wi-Fi hardware in the ath12k family. The bundle cites testing on QCN9274. Systems without this driver or hardware are less likely to be exposed.

Exploitation context

No source in the bundle reports active exploitation, and KEV is false. The evidence describes a memory leak during driver unregister handling, not a demonstrated exploit path. Practical exploitability and attacker prerequisites are not established in the provided sources.

Researcher notes

The record lacks CVSS, CWE, and detailed affected-version semantics. Avoid overclassifying impact. Focus validation on ath12k driver presence, Qualcomm Wi-Fi hardware, and whether downstream kernels contain the cleanup-path fix.

Mitigation direction

  • Apply a Linux kernel update containing the referenced stable fixes.
  • Prioritize affected systems using ath12k-supported Qualcomm Wi-Fi hardware.
  • Check Linux distribution advisories for backported fixes and supported kernel packages.
  • If updates are delayed, monitor affected systems for abnormal kernel memory growth.

Validation and detection

  • Inventory Linux kernel versions on systems with Wi-Fi hardware.
  • Confirm whether ath12k is present and used on target systems.
  • Verify the running kernel includes the referenced upstream stable commits.
  • Review vendor or distribution advisories for exact fixed package versions.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53767 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd889913205cf7ebda905b1e62c5867ed4e39f6c2, d889913205cf7ebda905b1e62c5867ed4e39f6c2unaffected
LinuxLinux6.3, 0, 6.3.4, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.