Riskcovery

CVE-2023-53476

iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()

State
Published
Severity
Not scored
Published
Oct 1, 2025
Updated
May 11, 2026
Reserved
Oct 1, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()

This condition needs to match the previous "if (epcp->state == LISTEN) {" exactly to avoid a NULL dereference of either "listen_ep" or "ep". The problem is that "epcp" has been re-assigned so just testing "if (epcp->state == LISTEN) {" a second time is not sufficient.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 116aeb8873712ea559d26b0d9d88147af5c88db5 to before 76e0396313c79ecd0df44ee3c18745cfac52b3e6Affected
  • 116aeb8873712ea559d26b0d9d88147af5c88db5 to before 24278dc380aab6a1aef0a75317f57ad4c2453cf6Affected
  • 116aeb8873712ea559d26b0d9d88147af5c88db5 to before dd55240e4364d64befcc575b0d33091881524f42Affected
  • 116aeb8873712ea559d26b0d9d88147af5c88db5 to before 4ca446b127c568b59cb8d9748b6f70499624bb18Affected
LinuxLinux
  • 4.18Affected
  • before 4.18Not affected
  • 5.15.99 through 5.15.*Not affected
  • 6.1.16 through 6.1.*Not affected
  • 6.2.3 through 6.2.*Not affected
  • 6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.