CVE-2023-53466

What it actually does

Failure to purge MCU skb queues in mt7915_mcu_exit when firmware state check fails leaves allocated buffers unreleased, causing a memory leak in the mt76/mt7915 wireless driver.

Why it matters to the business

Prolonged operation of affected wireless hardware can lead to gradual memory exhaustion, potential system instability, or crashes in Linux environments using the mt7915 driver; low EPSS and no KEV status indicate limited immediate risk despite 394 days since publication.

How an attack unfolds

An attacker with local access or the ability to trigger repeated firmware initialization failures in the mt7915 driver can cause repeated allocation without corresponding deallocation; the listed threat actor reference to CVE-2024-58240 appears unrelated to this kernel driver issue.

How to fix it

Update to fixed versions: Linux kernel commit 4cbb876153b63fe248200f734069c6881cf97722 or later; for listed Debian packages apply mutt 1.14.3-1 or neomutt 20200619+dfsg.1-1 as applicable.

How to confirm the fix worked

Confirm kernel version includes the purge of mcu skb queues in mt7915_mcu_exit regardless of firmware_state result; inspect dmesg or memory usage patterns post-update under repeated driver load/unload cycles.

Typical attack path

1. Obtain local access or ability to interact with mt7915 wireless hardware initialization
2. Trigger conditions that cause mt7915_firmware_state to fail during driver exit paths
3. Repeat the failure scenario to accumulate unreleased skb buffers
4. Monitor for memory pressure or system instability resulting from the leak

How to detect it

Search kernel logs and driver traces for repeated mt7915_mcu_exit entries without corresponding skb queue purges; correlate with memory allocation counters in /proc or similar system interfaces for leak indicators.

What your security team should do

• Prioritize kernel updates on systems using mt7915 hardware within standard patching cycles given low EPSS
• Monitor memory utilization on wireless-enabled Linux hosts for anomalous growth patterns
• Review downstream package ecosystems for any additional dependents beyond the listed Debian entries