CVE-2023-54275

What it actually does

Missing crypto_free_shash() call in the error path of ath11k_peer_rx_frag_setup after crypto_alloc_shash() succeeds but ath11k_peer_find() fails, resulting in a kernel memory leak.

Why it matters to the business

Gradual memory exhaustion on affected Linux WiFi systems can degrade performance or cause instability over extended operation; low exploit likelihood limits immediate risk despite wide kernel prevalence.

How an attack unfolds

An attacker would need repeated local or driver-triggered conditions that invoke ath11k_peer_rx_frag_setup and hit the specific failure path after hash allocation, slowly consuming memory without direct remote code execution paths observed.

How to fix it

Apply kernel updates containing commit 137963e3b95776f1d57c62f249a93fe47e019a22 or upgrade affected packages such as gcc-12 to 12.2.0-14-e1; rebuild and reboot systems using the fixed stable trees.

How to confirm the fix worked

Confirm presence of the fix commit in the running kernel source or package version; monitor for absence of repeated crypto shash allocations without corresponding frees in ath11k code paths under test workloads.

Typical attack path

1. Trigger ath11k_peer_rx_frag_setup via WiFi fragment processing
2. Force ath11k_peer_find() to fail after crypto_alloc_shash() allocation
3. Repeat to accumulate leaked shash resources
4. Observe system memory pressure or OOM conditions over time

How to detect it

Review kernel logs and memory accounting for ath11k-related shash allocations that persist after peer lookup failures; no public exploit artifacts or threat actor campaigns are associated with this issue.

What your security team should do

• Prioritize patching WiFi-enabled Linux systems within standard maintenance windows given low EPSS and no KEV listing
• Audit kernel configurations for ath11k usage and apply fixed versions from stable git trees
• Monitor memory usage trends on affected devices post-deployment to validate leak resolution