CVE-2023-53153

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: Fix use after free for wext

Key information in wext.connect is not reset on (re)connect and can hold data from a previous connection.

Reset key data to avoid that drivers or mac80211 incorrectly detect a WEP connection request and access the freed or already reused memory.

Additionally optimize cfg80211_sme_connect() and avoid an useless schedule of conn_work.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= fffd0934b9390f34bec45762192b7edd3b12b4b5, < 66af4a2ab1d65d556d638cb9555a3b823c2557a9; >= fffd0934b9390f34bec45762192b7edd3b12b4b5, < a2a92b3e9d8e03ee3f9ee407fc46a9b4bd02d8b6; >= fffd0934b9390f34bec45762192b7edd3b12b4b5, < 6f1959c17d4cb5b74af6fc31dc787e1dc3e4f6e2; >= fffd0934b9390f34bec45762192b7edd3b12b4b5, < 2cfe78619b0de6d2da773978bc2d22797212eaa7; >= fffd0934b9390f34bec45762192b7edd3b12b4b5, < fd081afd21eb35b968b0330700c43ec94986e1c4; >= fffd0934b9390f34bec45762192b7edd3b12b4b5, < 22dfb21bf1cd876616d45cda1bc6daa89eec6747; >= fffd0934b9390f34bec45762192b7edd3b12b4b5, < f4b6a138efb8a32507b8946104e32cb926308da7; >= fffd0934b9390f34bec45762192b7edd3b12b4b5, < 015b8cc5e7c4d7bb671f1984d7b7338c310b185b
LinuxLinux2.6.32

References

Timeline

Published
Sep 15, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-531545.5parse_string in cJSON before 1.7.18 has a heap-based buffer over-read via {"1":1, with no trailing newline if cJSON_ParseWithLength is calleCVE-2023-531557.2goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter.CVE-2023-531565.3The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.CVE-2023-531577.5The rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet.CVE-2023-531584.1The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: CVE-2023-531593.3The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.CVE-2023-53166.1Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.CVE-2023-531605.3The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.CVE-2023-531615.3The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic.CVE-2023-531635.5In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: don't hold ni_lock when calling truncate_setsize() syzbot isCVE-2023-531645.5In the Linux kernel, the following vulnerability has been resolved: irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe of_iCVE-2023-531655.5In the Linux kernel, the following vulnerability has been resolved: udf: Fix uninitialized array access for some pathnames For filenames t
CVE-2023-53153: High severity, CVSS 7.8 | Vulnix