In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix use after free for wext Key information in wext.connect is not reset on (re)connect and can hold data from a previous connection. Reset key data to avoid that drivers or mac80211 incorrectly detect a WEP connection request and access the freed or already reused memory. Additionally optimize cfg80211_sme_connect() and avoid an useless schedule of conn_work.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/015b8cc5e7c4d7bb671f1984d7b7338c310b185b cve-icon cve-icon
https://git.kernel.org/stable/c/22dfb21bf1cd876616d45cda1bc6daa89eec6747 cve-icon cve-icon
https://git.kernel.org/stable/c/2cfe78619b0de6d2da773978bc2d22797212eaa7 cve-icon cve-icon
https://git.kernel.org/stable/c/66af4a2ab1d65d556d638cb9555a3b823c2557a9 cve-icon cve-icon
https://git.kernel.org/stable/c/6f1959c17d4cb5b74af6fc31dc787e1dc3e4f6e2 cve-icon cve-icon
https://git.kernel.org/stable/c/a2a92b3e9d8e03ee3f9ee407fc46a9b4bd02d8b6 cve-icon cve-icon
https://git.kernel.org/stable/c/f4b6a138efb8a32507b8946104e32cb926308da7 cve-icon cve-icon
https://git.kernel.org/stable/c/fd081afd21eb35b968b0330700c43ec94986e1c4 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025091553-CVE-2023-53153-d85c@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-53153 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-53153 cve-icon
History

Mon, 24 Nov 2025 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 17 Sep 2025 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Tue, 16 Sep 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Mon, 15 Sep 2025 14:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix use after free for wext Key information in wext.connect is not reset on (re)connect and can hold data from a previous connection. Reset key data to avoid that drivers or mac80211 incorrectly detect a WEP connection request and access the freed or already reused memory. Additionally optimize cfg80211_sme_connect() and avoid an useless schedule of conn_work.
Title wifi: cfg80211: Fix use after free for wext
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-09-15T14:03:21.590Z

Updated: 2025-09-15T14:03:21.590Z

Reserved: 2025-05-02T15:51:43.566Z

Link: CVE-2023-53153

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2025-09-15T14:15:37.860

Modified: 2025-11-24T21:01:22.723

Link: CVE-2023-53153

cve-icon Redhat

Severity : Important

Publid Date: 2025-09-15T00:00:00Z

Links: CVE-2023-53153 - Bugzilla