CVE-2023-53589

wifi: iwlwifi: mvm: don't trust firmware n_channels

State: Published
Severity: 8.8 High
Published: Oct 4, 2025
Updated: Oct 15, 2026
Reserved: Oct 4, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: don't trust firmware n_channels

If the firmware sends us a corrupted MCC response with n_channels much larger than the command response can be, we might copy far too much (uninitialized) memory and even crash if the n_channels is large enough to make it run out of the one page allocated for the FW response.

Fix that by checking the lengths. Doing a < comparison would be sufficient, but the firmware should be doing it correctly, so check more strictly.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	dcaf9f5ecb6f395152609bdc40660d9b593dca63 to before e519a404a5bbba37693cb10fa61794a5fce4fd9bAffected dcaf9f5ecb6f395152609bdc40660d9b593dca63 to before d0d39bed9e95f27a246be91c5929254ac043ed30Affected dcaf9f5ecb6f395152609bdc40660d9b593dca63 to before 05ad5a4d421ce65652fcb24d46b7e273130240d6Affected dcaf9f5ecb6f395152609bdc40660d9b593dca63 to before 557ba100d8cf3661ff8d71c0b4a2cba8db555ec2Affected dcaf9f5ecb6f395152609bdc40660d9b593dca63 to before c176f03350954b795322de0bfe1d7b514db41f45Affected dcaf9f5ecb6f395152609bdc40660d9b593dca63 to before 682b6dc29d98e857e6ca4bbc077c7dc2899b7473Affected
LinuxLinux	4.1Affected before 4.1Not affected 5.4.244 through 5.4.Not affected 5.10.181 through 5.10.Not affected 5.15.113 through 5.15.Not affected 6.1.30 through 6.1.Not affected 6.3.4 through 6.3.*Not affected 6.4 and laterNot affected

Product

Versions

LinuxLinux

dcaf9f5ecb6f395152609bdc40660d9b593dca63 to before e519a404a5bbba37693cb10fa61794a5fce4fd9bAffected
dcaf9f5ecb6f395152609bdc40660d9b593dca63 to before d0d39bed9e95f27a246be91c5929254ac043ed30Affected
dcaf9f5ecb6f395152609bdc40660d9b593dca63 to before 05ad5a4d421ce65652fcb24d46b7e273130240d6Affected
dcaf9f5ecb6f395152609bdc40660d9b593dca63 to before 557ba100d8cf3661ff8d71c0b4a2cba8db555ec2Affected
dcaf9f5ecb6f395152609bdc40660d9b593dca63 to before c176f03350954b795322de0bfe1d7b514db41f45Affected
dcaf9f5ecb6f395152609bdc40660d9b593dca63 to before 682b6dc29d98e857e6ca4bbc077c7dc2899b7473Affected

LinuxLinux

4.1Affected
before 4.1Not affected
5.4.244 through 5.4.*Not affected
5.10.181 through 5.10.*Not affected
5.15.113 through 5.15.*Not affected
6.1.30 through 6.1.*Not affected
6.3.4 through 6.3.*Not affected
6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.