PT-2025-40239 · Linux+4 · Linux Kernel+4

Published 2023-03-09 · Updated 2025-10-23 · CVE-2023-53532

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the ath11k module related to the deinitialization of firmware resources. Specifically, the issue arises during system shutdown or module removal when handling chipsets without fixed firmware memory regions. The code attempts to unmap memory that was never initially mapped, leading to a kernel NULL pointer dereference. This can be triggered by probing an AHB chipset lacking a fixed memory region, resulting in a system crash. The trace indicates a problem within the iommu unmap and iommu unmap functions, originating from the ath11k ahb fw resource deinit function. The fix involves adding a condition check based on the firmware fixed memory hardware parameter, similar to the initialization process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Uninitialized Resource

NULL Pointer Dereference

Weakness Enumeration

CWE-908

CWE-476

Related Identifiers

ALSA-2025_16880

BDU:2025-16238

CESA-2023_7077

CVE-2023-53532

RHSA-2023:6583

RHSA-2023:7077

RHSA-2023_6583

RHSA-2023_7077

SUSE-SU-2025:03615-1

SUSE-SU-2025:3761-1

Affected Products

Centos

Linux Kernel

Red Hat

Suse

Ath11K

References · 838

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53532.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53532 · Security Note
• https://git.kernel.org/stable/c/a1548363582a8066edd4986f839d785f13dda3aa · Patch
• https://git.kernel.org/stable/c/5a78ac33e3cb8822da64dd1af196e83664b332b0 · Patch
• https://git.kernel.org/stable/c/8faf862d81ab197757761e87d0a99fbb96ab2cf0 · Patch
• https://bdu.fstec.ru/vul/2025-16238 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53532 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03615-1 · Vendor Advisory
• https://git.kernel.org/stable/c/0324300dce3412d4737b4ec5898d0188495a7caa · Patch
• https://osv.dev/vulnerability/BELL-CVE-2023-53532 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-53532 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-53532 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-53532 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-53532 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:3761-1 · Vendor Advisory