CVE-2023-53460

What it actually does

Memory leak in rtw_usb_probe() where ieee80211_alloc_hw() result 'hw' is not freed on error paths before lines 811 and 876 in drivers/net/wireless/realtek/rtw88/usb.c.

Why it matters to the business

Repeated module loading or probe failures on systems using affected Realtek USB Wi-Fi hardware can gradually exhaust kernel memory, causing performance degradation or instability; low exploitability reduces immediate risk but kernel updates remain necessary for long-term stability.

How an attack unfolds

An attacker with local access or ability to trigger repeated USB device insertion/removal or driver reloads could force the error path in rtw_usb_probe(), leaking small amounts of kernel memory per failure; no public exploits or threat actor campaigns are known given the low EPSS and absence from KEV.

How to fix it

Update the Linux kernel to a version containing commit 6cc92379b80af005e1f49ef6ef790cddc58cf0da or later; rebuild and reboot with the patched kernel; ensure rtw88 USB driver is included in the update.

How to confirm the fix worked

Confirm the running kernel source contains commit 6cc92379b80af005e1f49ef6ef790cddc58cf0da; recompile with static analysis tools to verify the goto-based cleanup path; test probe error paths with USB device insertion under memory pressure.

Typical attack path

1. Gain local access or physical USB port access to target system
2. Trigger conditions that cause rtw_usb_probe() to hit error paths (e.g., repeated device attach/detach or module reload)
3. Accumulate leaked 'hw' structures over multiple attempts until memory pressure occurs

How to detect it

Review kernel logs for repeated rtw_usb_probe failures or warnings referencing ieee80211_alloc_hw without corresponding release; correlate with USB device attach events; no specific runtime IOCs are available for post-exploitation detection.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on any system exposing Realtek rtw88 USB Wi-Fi hardware
• Monitor kernel memory usage on affected devices as a temporary indicator
• Apply the update within standard maintenance windows given low EPSS and no known active exploitation