From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AB2F831BCB6 for ; Wed, 24 Dec 2025 12:28:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766579285; cv=none; b=CSj0dfC3MlrBXIVg6qfzixzwSgw6adQpa6uxSq60bjLvKuXykAgGdRRWngrWI3Iwd9jksFzW+JfmEe9Lq0s36vN+7Yt/TmB0SZnfVvZRZ75xkyBBjsjBSVPT3k6+DKSrgn51slSMI5cCauFaZupKq0LS4PeS8IM3ZfmZAQhPBwY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766579285; c=relaxed/simple; bh=bF8kJRlVrKQrEZLfv2e2NFeAIbd2ATBjzhFg5Sv/Sdo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=DhYGgiEtXFug5hOXHiubTUlFOAPIOi05QlUGWFQPYOxeZ0oL7CFyONEdGshzsO1wwY3ooFn1gjKDta+b6FoOyE90DoEfVha+daQ3RwaeaNPiQX1KaGtENyTS6Af1OQjYxjysnn96S5VZ3kuCIY7ebFZcEF+DPj2cORIP4wq0ROw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Ee7KmirC; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Ee7KmirC" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 33AC5C116D0; Wed, 24 Dec 2025 12:28:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1766579285; bh=bF8kJRlVrKQrEZLfv2e2NFeAIbd2ATBjzhFg5Sv/Sdo=; h=From:To:Cc:Subject:Date:Reply-To:From; b=Ee7KmirCL7PKHp6/aT0HFRV4bIcKaJrNeofSQH8rj23GeU3Q7XmvsxzVopoZMFhel Dd38jnkTdmDd8/tcIjIm2bnSmMMPjOPcZ8HU60XsQlO/90d7U+L1RRAfO8omPprGs7 JcWdk8s20kfkaRrGVtgMWoAyXW6uKh7UgQWHt5MQ= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2023-54052: wifi: mt76: mt7921: fix skb leak by txs missing in AMSDU Date: Wed, 24 Dec 2025 13:26:45 +0100 Message-ID: <2025122425-CVE-2023-54052-302d@gregkh> X-Mailer: git-send-email 2.52.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2528; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=1IeB7Q3e+SUqejczGrkuGQ/vkxKtbIBbO6lxDKccZxo=; b=kA0DAAIRMUfUDdst+ykByyZiAGlL2/Gj6bER1A4GEEtemPqpUYGujLkD1hkFe+4JR/piS+/qG ohdBAARAgAdFiEE9LYMxb94wiFKMT3LMUfUDdst+ykFAmlL2/EACgkQMUfUDdst+yluOACeM07f 2LNtcMi+S7Ydr2mon02+GvYAoKC43n4YXPVR651buLUJ8/9JhVoB X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix skb leak by txs missing in AMSDU txs may be dropped if the frame is aggregated in AMSDU. When the problem shows up, some SKBs would be hold in driver to cause network stopped temporarily. Even if the problem can be recovered by txs timeout handling, mt7921 still need to disable txs in AMSDU to avoid this issue. The Linux kernel CVE team has assigned CVE-2023-54052 to this issue. Affected and fixed versions =========================== Issue introduced in 5.12 with commit 163f4d22c118d4eb9e275bf9ee1577c0d14b3208 and fixed in 6.1.52 with commit 1cd102aaedb277fbe81dd08cd9f5cae951de2bff Issue introduced in 5.12 with commit 163f4d22c118d4eb9e275bf9ee1577c0d14b3208 and fixed in 6.4.15 with commit e74778e91fedc3b2a0143264887bbb32508c5000 Issue introduced in 5.12 with commit 163f4d22c118d4eb9e275bf9ee1577c0d14b3208 and fixed in 6.5.2 with commit bf5d3fad7219b8de7d3a9cb59f0ea5243b018f07 Issue introduced in 5.12 with commit 163f4d22c118d4eb9e275bf9ee1577c0d14b3208 and fixed in 6.6 with commit b642f4c5f3de0a8f47808d32b1ebd9c427a42a66 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-54052 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/1cd102aaedb277fbe81dd08cd9f5cae951de2bff https://git.kernel.org/stable/c/e74778e91fedc3b2a0143264887bbb32508c5000 https://git.kernel.org/stable/c/bf5d3fad7219b8de7d3a9cb59f0ea5243b018f07 https://git.kernel.org/stable/c/b642f4c5f3de0a8f47808d32b1ebd9c427a42a66