CVE-2023-52594: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-06 · updated 2026-06-17
Weakness: CWE-129

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() Fix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug occurs when txs->cnt, data from a URB provided by a USB device, is bigger than the size of the array txs->txstatus, which is HTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug handling code after the check. Make the function return if that is the case. Found by a modified version of syzkaller. UBSAN: array-index-out-of-bounds in htc_drv_txrx.c index 13 is out of range for type '__wmi_event_txstatus [12]' Call Trace: ath9k_htc_txstatus ath9k_wmi_event_tasklet tasklet_action_common __do_softirq irq_exit_rxu sysvec_apic_timer_interrupt

Affected products

Linux kernel: before 4.19.307; from 4.20 before 5.4.269; from 5.5 before 5.10.210; from 5.11 before 5.15.149; from 5.16 before 6.1.77; from 6.2 before 6.6.16 — fixed in 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.77, 6.6.16

How to fix

Upgrade to a fixed version: Linux kernel 4.19.307, 5.10.210, 5.15.149, 5.4.269. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-52594 or the next vulnerability affects your stack