GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53086 (GCVE-0-2023-53086)

Vulnerability from cvelistv5 – Published: 2025-05-02 15:55 – Updated: 2026-08-05 09:12
VLAI
Title
wifi: mt76: connac: do not check WED status for non-mmio devices
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: connac: do not check WED status for non-mmio devices WED is supported just for mmio devices, so do not check it for usb or sdio devices. This patch fixes the crash reported below: [ 21.946627] wlp0s3u1i3: authenticate with c4:41:1e:f5:2b:1d [ 22.525298] wlp0s3u1i3: send auth to c4:41:1e:f5:2b:1d (try 1/3) [ 22.548274] wlp0s3u1i3: authenticate with c4:41:1e:f5:2b:1d [ 22.557694] wlp0s3u1i3: send auth to c4:41:1e:f5:2b:1d (try 1/3) [ 22.565885] wlp0s3u1i3: authenticated [ 22.569502] wlp0s3u1i3: associate with c4:41:1e:f5:2b:1d (try 1/3) [ 22.578966] wlp0s3u1i3: RX AssocResp from c4:41:1e:f5:2b:1d (capab=0x11 status=30 aid=3) [ 22.579113] wlp0s3u1i3: c4:41:1e:f5:2b:1d rejected association temporarily; comeback duration 1000 TU (1024 ms) [ 23.649518] wlp0s3u1i3: associate with c4:41:1e:f5:2b:1d (try 2/3) [ 23.752528] wlp0s3u1i3: RX AssocResp from c4:41:1e:f5:2b:1d (capab=0x11 status=0 aid=3) [ 23.797450] wlp0s3u1i3: associated [ 24.959527] kernel tried to execute NX-protected page - exploit attempt? (uid: 0) [ 24.959640] BUG: unable to handle page fault for address: ffff88800c223200 [ 24.959706] #PF: supervisor instruction fetch in kernel mode [ 24.959788] #PF: error_code(0x0011) - permissions violation [ 24.959846] PGD 2c01067 P4D 2c01067 PUD 2c02067 PMD c2a8063 PTE 800000000c223163 [ 24.959957] Oops: 0011 [#1] PREEMPT SMP [ 24.960009] CPU: 0 PID: 391 Comm: wpa_supplicant Not tainted 6.2.0-kvm #18 [ 24.960089] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014 [ 24.960191] RIP: 0010:0xffff88800c223200 [ 24.960446] RSP: 0018:ffffc90000ff7698 EFLAGS: 00010282 [ 24.960513] RAX: ffff888028397010 RBX: ffff88800c26e630 RCX: 0000000000000058 [ 24.960598] RDX: ffff88800c26f844 RSI: 0000000000000006 RDI: ffff888028397010 [ 24.960682] RBP: ffff88800ea72f00 R08: 18b873fbab2b964c R09: be06b38235f3c63c [ 24.960766] R10: 18b873fbab2b964c R11: be06b38235f3c63c R12: 0000000000000001 [ 24.960853] R13: ffff88800c26f84c R14: ffff8880063f0ff8 R15: ffff88800c26e644 [ 24.960950] FS: 00007effcea327c0(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 [ 24.961036] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.961106] CR2: ffff88800c223200 CR3: 000000000eaa2000 CR4: 00000000000006b0 [ 24.961190] Call Trace: [ 24.961219] <TASK> [ 24.961245] ? mt76_connac_mcu_add_key+0x2cf/0x310 [ 24.961313] ? mt7921_set_key+0x150/0x200 [ 24.961365] ? drv_set_key+0xa9/0x1b0 [ 24.961418] ? ieee80211_key_enable_hw_accel+0xd9/0x240 [ 24.961485] ? ieee80211_key_replace+0x3f3/0x730 [ 24.961541] ? crypto_shash_setkey+0x89/0xd0 [ 24.961597] ? ieee80211_key_link+0x2d7/0x3a0 [ 24.961664] ? crypto_aead_setauthsize+0x31/0x50 [ 24.961730] ? sta_info_hash_lookup+0xa6/0xf0 [ 24.961785] ? ieee80211_add_key+0x1fc/0x250 [ 24.961842] ? rdev_add_key+0x41/0x140 [ 24.961882] ? nl80211_parse_key+0x6c/0x2f0 [ 24.961940] ? nl80211_new_key+0x24a/0x290 [ 24.961984] ? genl_rcv_msg+0x36c/0x3a0 [ 24.962036] ? rdev_mod_link_station+0xe0/0xe0 [ 24.962102] ? nl80211_set_key+0x410/0x410 [ 24.962143] ? nl80211_pre_doit+0x200/0x200 [ 24.962187] ? genl_bind+0xc0/0xc0 [ 24.962217] ? netlink_rcv_skb+0xaa/0xd0 [ 24.962259] ? genl_rcv+0x24/0x40 [ 24.962300] ? netlink_unicast+0x224/0x2f0 [ 24.962345] ? netlink_sendmsg+0x30b/0x3d0 [ 24.962388] ? ____sys_sendmsg+0x109/0x1b0 [ 24.962388] ? ____sys_sendmsg+0x109/0x1b0 [ 24.962440] ? __import_iovec+0x2e/0x110 [ 24.962482] ? ___sys_sendmsg+0xbe/0xe0 [ 24.962525] ? mod_objcg_state+0x25c/0x330 [ 24.962576] ? __dentry_kill+0x19e/0x1d0 [ 24.962618] ? call_rcu+0x18f/0x270 [ 24.962660] ? __dentry_kill+0x19e/0x1d0 [ 24.962702] ? __x64_sys_sendmsg+0x70/0x90 [ 24.962744] ? do_syscall_64+0x3d/0x80 [ 24.962796] ? exit_to_user_mode_prepare+0x1b/0x70 [ 24.962852] ? entry_SYSCA ---truncated---
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d1369e515efe6b5d04e9a5f5884106643f7b1d8a , < 53edfda851dd1ce41ac049ce2f195dc41dd27cc1 (git)
Affected: d1369e515efe6b5d04e9a5f5884106643f7b1d8a , < 5683e1488aa9b0805a9403d215e48fed29d6d923 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.2.9 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "53edfda851dd1ce41ac049ce2f195dc41dd27cc1",
              "status": "affected",
              "version": "d1369e515efe6b5d04e9a5f5884106643f7b1d8a",
              "versionType": "git"
            },
            {
              "lessThan": "5683e1488aa9b0805a9403d215e48fed29d6d923",
              "status": "affected",
              "version": "d1369e515efe6b5d04e9a5f5884106643f7b1d8a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.9",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: connac: do not check WED status for non-mmio devices\n\nWED is supported just for mmio devices, so do not check it for usb or\nsdio devices. This patch fixes the crash reported below:\n\n[   21.946627] wlp0s3u1i3: authenticate with c4:41:1e:f5:2b:1d\n[   22.525298] wlp0s3u1i3: send auth to c4:41:1e:f5:2b:1d (try 1/3)\n[   22.548274] wlp0s3u1i3: authenticate with c4:41:1e:f5:2b:1d\n[   22.557694] wlp0s3u1i3: send auth to c4:41:1e:f5:2b:1d (try 1/3)\n[   22.565885] wlp0s3u1i3: authenticated\n[   22.569502] wlp0s3u1i3: associate with c4:41:1e:f5:2b:1d (try 1/3)\n[   22.578966] wlp0s3u1i3: RX AssocResp from c4:41:1e:f5:2b:1d (capab=0x11 status=30 aid=3)\n[   22.579113] wlp0s3u1i3: c4:41:1e:f5:2b:1d rejected association temporarily; comeback duration 1000 TU (1024 ms)\n[   23.649518] wlp0s3u1i3: associate with c4:41:1e:f5:2b:1d (try 2/3)\n[   23.752528] wlp0s3u1i3: RX AssocResp from c4:41:1e:f5:2b:1d (capab=0x11 status=0 aid=3)\n[   23.797450] wlp0s3u1i3: associated\n[   24.959527] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)\n[   24.959640] BUG: unable to handle page fault for address: ffff88800c223200\n[   24.959706] #PF: supervisor instruction fetch in kernel mode\n[   24.959788] #PF: error_code(0x0011) - permissions violation\n[   24.959846] PGD 2c01067 P4D 2c01067 PUD 2c02067 PMD c2a8063 PTE 800000000c223163\n[   24.959957] Oops: 0011 [#1] PREEMPT SMP\n[   24.960009] CPU: 0 PID: 391 Comm: wpa_supplicant Not tainted 6.2.0-kvm #18\n[   24.960089] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014\n[   24.960191] RIP: 0010:0xffff88800c223200\n[   24.960446] RSP: 0018:ffffc90000ff7698 EFLAGS: 00010282\n[   24.960513] RAX: ffff888028397010 RBX: ffff88800c26e630 RCX: 0000000000000058\n[   24.960598] RDX: ffff88800c26f844 RSI: 0000000000000006 RDI: ffff888028397010\n[   24.960682] RBP: ffff88800ea72f00 R08: 18b873fbab2b964c R09: be06b38235f3c63c\n[   24.960766] R10: 18b873fbab2b964c R11: be06b38235f3c63c R12: 0000000000000001\n[   24.960853] R13: ffff88800c26f84c R14: ffff8880063f0ff8 R15: ffff88800c26e644\n[   24.960950] FS:  00007effcea327c0(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000\n[   24.961036] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   24.961106] CR2: ffff88800c223200 CR3: 000000000eaa2000 CR4: 00000000000006b0\n[   24.961190] Call Trace:\n[   24.961219]  \u003cTASK\u003e\n[   24.961245]  ? mt76_connac_mcu_add_key+0x2cf/0x310\n[   24.961313]  ? mt7921_set_key+0x150/0x200\n[   24.961365]  ? drv_set_key+0xa9/0x1b0\n[   24.961418]  ? ieee80211_key_enable_hw_accel+0xd9/0x240\n[   24.961485]  ? ieee80211_key_replace+0x3f3/0x730\n[   24.961541]  ? crypto_shash_setkey+0x89/0xd0\n[   24.961597]  ? ieee80211_key_link+0x2d7/0x3a0\n[   24.961664]  ? crypto_aead_setauthsize+0x31/0x50\n[   24.961730]  ? sta_info_hash_lookup+0xa6/0xf0\n[   24.961785]  ? ieee80211_add_key+0x1fc/0x250\n[   24.961842]  ? rdev_add_key+0x41/0x140\n[   24.961882]  ? nl80211_parse_key+0x6c/0x2f0\n[   24.961940]  ? nl80211_new_key+0x24a/0x290\n[   24.961984]  ? genl_rcv_msg+0x36c/0x3a0\n[   24.962036]  ? rdev_mod_link_station+0xe0/0xe0\n[   24.962102]  ? nl80211_set_key+0x410/0x410\n[   24.962143]  ? nl80211_pre_doit+0x200/0x200\n[   24.962187]  ? genl_bind+0xc0/0xc0\n[   24.962217]  ? netlink_rcv_skb+0xaa/0xd0\n[   24.962259]  ? genl_rcv+0x24/0x40\n[   24.962300]  ? netlink_unicast+0x224/0x2f0\n[   24.962345]  ? netlink_sendmsg+0x30b/0x3d0\n[   24.962388]  ? ____sys_sendmsg+0x109/0x1b0\n[   24.962388]  ? ____sys_sendmsg+0x109/0x1b0\n[   24.962440]  ? __import_iovec+0x2e/0x110\n[   24.962482]  ? ___sys_sendmsg+0xbe/0xe0\n[   24.962525]  ? mod_objcg_state+0x25c/0x330\n[   24.962576]  ? __dentry_kill+0x19e/0x1d0\n[   24.962618]  ? call_rcu+0x18f/0x270\n[   24.962660]  ? __dentry_kill+0x19e/0x1d0\n[   24.962702]  ? __x64_sys_sendmsg+0x70/0x90\n[   24.962744]  ? do_syscall_64+0x3d/0x80\n[   24.962796]  ? exit_to_user_mode_prepare+0x1b/0x70\n[   24.962852]  ? entry_SYSCA\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in the mt76 WiFi driver and is reached when an adjacent peer associates (key install via SoftAP/hotspot or client association) or sends ADDBA frames that drive mt7921_ampdu_action\u2192mt76_connac_mcu_sta_ba\u2192mt76_connac_mcu_sta_wed_u pdate on the same radio segment.\nAC:L - On USB/SDIO devices with WED enabled, the mmio/usb union overlay makes wed.ops non-NULL from live USB state (e.g. mutex wait_list), so association or BA setup reliably takes the confused ops\u2192msg_update path with no race or attacker-uncontrollable layout dependency.\nPR:N - An adjacent attacker needs no account or capability on the victim host; open SoftAP/hotspot association or evil-twin association plus ADDBA drives the vulnerable path without OS authentication.\nUI:N - Once SoftAP/hotspot is running, or the client auto-reconnects to a saved SSID evil twin, the attacker triggers the bug solely via over-the-air association/BA setup with no further victim action.\nS:U - Impact is confined to the host kernel WiFi driver within the same security authority; there is no VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - Type confusion treats USB/SDIO union memory as mtk_wed_device and performs an indirect call through a confused ops table, which is memory-corruption/control-flow diversion that can be leveraged for kernel information disclosure primitives.\nI:H - The same type confusion yields a wild function-pointer call (ops\u2192msg_update), matching kernel type-confusion guidance for High integrity impact and enabling control-flow hijack / wrong-function invocation with skb contents influenced by peer frames.\nA:H - The reported crash is a kernel oops from executing an NX-protected data page via the confused indirect call, causing full denial of service on affected systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:12:41.291Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/53edfda851dd1ce41ac049ce2f195dc41dd27cc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/5683e1488aa9b0805a9403d215e48fed29d6d923"
        }
      ],
      "title": "wifi: mt76: connac: do not check WED status for non-mmio devices",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53086",
    "datePublished": "2025-05-02T15:55:33.578Z",
    "dateReserved": "2025-05-02T15:51:43.551Z",
    "dateUpdated": "2026-08-05T09:12:41.291Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53086",
      "date": "2026-09-19",
      "epss": "0.00199",
      "percentile": "0.10015"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "53edfda851dd1ce41ac049ce2f195dc41dd27cc1",
                    "status": "affected",
                    "version": "d1369e515efe6b5d04e9a5f5884106643f7b1d8a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5683e1488aa9b0805a9403d215e48fed29d6d923",
                    "status": "affected",
                    "version": "d1369e515efe6b5d04e9a5f5884106643f7b1d8a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.2"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "914F22DD-1E6F-4B0A-A14D-3A9F068F6761",
                    "versionEndExcluding": "6.2.9",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B8E3B0E8-FA27-4305-87BB-AF6C25B160CB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "A47F0FC3-CE52-4BA1-BA51-22F783938431",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "3583026A-27EC-4A4C-850A-83F2AF970673",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: connac: do not check WED status for non-mmio devices\n\nWED is supported just for mmio devices, so do not check it for usb or\nsdio devices. This patch fixes the crash reported below:\n\n[   21.946627] wlp0s3u1i3: authenticate with c4:41:1e:f5:2b:1d\n[   22.525298] wlp0s3u1i3: send auth to c4:41:1e:f5:2b:1d (try 1/3)\n[   22.548274] wlp0s3u1i3: authenticate with c4:41:1e:f5:2b:1d\n[   22.557694] wlp0s3u1i3: send auth to c4:41:1e:f5:2b:1d (try 1/3)\n[   22.565885] wlp0s3u1i3: authenticated\n[   22.569502] wlp0s3u1i3: associate with c4:41:1e:f5:2b:1d (try 1/3)\n[   22.578966] wlp0s3u1i3: RX AssocResp from c4:41:1e:f5:2b:1d (capab=0x11 status=30 aid=3)\n[   22.579113] wlp0s3u1i3: c4:41:1e:f5:2b:1d rejected association temporarily; comeback duration 1000 TU (1024 ms)\n[   23.649518] wlp0s3u1i3: associate with c4:41:1e:f5:2b:1d (try 2/3)\n[   23.752528] wlp0s3u1i3: RX AssocResp from c4:41:1e:f5:2b:1d (capab=0x11 status=0 aid=3)\n[   23.797450] wlp0s3u1i3: associated\n[   24.959527] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)\n[   24.959640] BUG: unable to handle page fault for address: ffff88800c223200\n[   24.959706] #PF: supervisor instruction fetch in kernel mode\n[   24.959788] #PF: error_code(0x0011) - permissions violation\n[   24.959846] PGD 2c01067 P4D 2c01067 PUD 2c02067 PMD c2a8063 PTE 800000000c223163\n[   24.959957] Oops: 0011 [#1] PREEMPT SMP\n[   24.960009] CPU: 0 PID: 391 Comm: wpa_supplicant Not tainted 6.2.0-kvm #18\n[   24.960089] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014\n[   24.960191] RIP: 0010:0xffff88800c223200\n[   24.960446] RSP: 0018:ffffc90000ff7698 EFLAGS: 00010282\n[   24.960513] RAX: ffff888028397010 RBX: ffff88800c26e630 RCX: 0000000000000058\n[   24.960598] RDX: ffff88800c26f844 RSI: 0000000000000006 RDI: ffff888028397010\n[   24.960682] RBP: ffff88800ea72f00 R08: 18b873fbab2b964c R09: be06b38235f3c63c\n[   24.960766] R10: 18b873fbab2b964c R11: be06b38235f3c63c R12: 0000000000000001\n[   24.960853] R13: ffff88800c26f84c R14: ffff8880063f0ff8 R15: ffff88800c26e644\n[   24.960950] FS:  00007effcea327c0(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000\n[   24.961036] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   24.961106] CR2: ffff88800c223200 CR3: 000000000eaa2000 CR4: 00000000000006b0\n[   24.961190] Call Trace:\n[   24.961219]  \u003cTASK\u003e\n[   24.961245]  ? mt76_connac_mcu_add_key+0x2cf/0x310\n[   24.961313]  ? mt7921_set_key+0x150/0x200\n[   24.961365]  ? drv_set_key+0xa9/0x1b0\n[   24.961418]  ? ieee80211_key_enable_hw_accel+0xd9/0x240\n[   24.961485]  ? ieee80211_key_replace+0x3f3/0x730\n[   24.961541]  ? crypto_shash_setkey+0x89/0xd0\n[   24.961597]  ? ieee80211_key_link+0x2d7/0x3a0\n[   24.961664]  ? crypto_aead_setauthsize+0x31/0x50\n[   24.961730]  ? sta_info_hash_lookup+0xa6/0xf0\n[   24.961785]  ? ieee80211_add_key+0x1fc/0x250\n[   24.961842]  ? rdev_add_key+0x41/0x140\n[   24.961882]  ? nl80211_parse_key+0x6c/0x2f0\n[   24.961940]  ? nl80211_new_key+0x24a/0x290\n[   24.961984]  ? genl_rcv_msg+0x36c/0x3a0\n[   24.962036]  ? rdev_mod_link_station+0xe0/0xe0\n[   24.962102]  ? nl80211_set_key+0x410/0x410\n[   24.962143]  ? nl80211_pre_doit+0x200/0x200\n[   24.962187]  ? genl_bind+0xc0/0xc0\n[   24.962217]  ? netlink_rcv_skb+0xaa/0xd0\n[   24.962259]  ? genl_rcv+0x24/0x40\n[   24.962300]  ? netlink_unicast+0x224/0x2f0\n[   24.962345]  ? netlink_sendmsg+0x30b/0x3d0\n[   24.962388]  ? ____sys_sendmsg+0x109/0x1b0\n[   24.962388]  ? ____sys_sendmsg+0x109/0x1b0\n[   24.962440]  ? __import_iovec+0x2e/0x110\n[   24.962482]  ? ___sys_sendmsg+0xbe/0xe0\n[   24.962525]  ? mod_objcg_state+0x25c/0x330\n[   24.962576]  ? __dentry_kill+0x19e/0x1d0\n[   24.962618]  ? call_rcu+0x18f/0x270\n[   24.962660]  ? __dentry_kill+0x19e/0x1d0\n[   24.962702]  ? __x64_sys_sendmsg+0x70/0x90\n[   24.962744]  ? do_syscall_64+0x3d/0x80\n[   24.962796]  ? exit_to_user_mode_prepare+0x1b/0x70\n[   24.962852]  ? entry_SYSCA\n---truncated---"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mt76: connac: no verifique el estado de WED para dispositivos que no sean mmio WED solo es compatible con dispositivos mmio, por lo que no lo verifique para dispositivos usb o sdio. Este parche corrige el fallo informado a continuaci\u00f3n: [ 21.946627] wlp0s3u1i3: autenticar con c4:41:1e:f5:2b:1d [ 22.525298] wlp0s3u1i3: enviar autenticaci\u00f3n a c4:41:1e:f5:2b:1d (intentar 1/3) [ 22.548274] wlp0s3u1i3: autenticar con c4:41:1e:f5:2b:1d [ 22.557694] wlp0s3u1i3: enviar autenticaci\u00f3n a c4:41:1e:f5:2b:1d (intentar 1/3) [ 22.565885] wlp0s3u1i3: autenticado [ 22.569502] wlp0s3u1i3: asociar con c4:41:1e:f5:2b:1d (try 1/3) [ 22.578966] wlp0s3u1i3: RX AssocResp de c4:41:1e:f5:2b:1d (capab=0x11 status=30 aid=3) [ 22.579113] wlp0s3u1i3: c4:41:1e:f5:2b:1d rechaz\u00f3 la asociaci\u00f3n temporalmente; duraci\u00f3n del regreso 1000 TU (1024 ms) [ 23.649518] wlp0s3u1i3: asociado con c4:41:1e:f5:2b:1d (intento 2/3) [ 23.752528] wlp0s3u1i3: RX AssocResp de c4:41:1e:f5:2b:1d (capab=0x11 status=0 aid=3) [ 23.797450] wlp0s3u1i3: asociado [ 24.959527] el kernel intent\u00f3 ejecutar p\u00e1gina protegida por NX - \u00bfintento de explotaci\u00f3n? (uid: 0) [24.959640] ERROR: no se puede manejar el error de p\u00e1gina para la direcci\u00f3n: ffff88800c223200 [24.959706] #PF: obtenci\u00f3n de instrucci\u00f3n de supervisor en modo kernel [24.959788] #PF: error_code(0x0011) - violaci\u00f3n de permisos [24.959846] PGD 2c01067 P4D 2c01067 PUD 2c02067 PMD c2a8063 PTE 800000000c223163 [24.959957] Oops: 0011 [#1] PREEMPT SMP [24.960009] CPU: 0 PID: 391 Comm: wpa_supplicant No contaminado 6.2.0-kvm #18 [ 24.960089] Nombre del hardware: PC est\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 01/04/2014 [ 24.960191] RIP: 0010:0xffff88800c223200 [ 24.960446] RSP: 0018:ffffc90000ff7698 EFLAGS: 00010282 [ 24.960513] RAX: ffff888028397010 RBX: ffff88800c26e630 RCX: 0000000000000058 [ 24.960598] RDX: ffff88800c26f844 RSI: 0000000000000006 RDI: ffff888028397010 [ 24.960682] RBP: ffff88800ea72f00 R08: 18b873fbab2b964c R09: be06b38235f3c63c [ 24.960766] R10: 18b873fbab2b964c R11: be06b38235f3c63c R12: 000000000000001 [ 24.960853] R13: ffff88800c26f84c R14: ffff8880063f0ff8 R15: ffff88800c26e644 [24.960950] FS: 00007effcea327c0(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 [24.961036] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [24.961106] CR2: ffff88800c223200 CR3: 000000000eaa2000 CR4: 00000000000006b0 [24.961190] Rastreo de llamadas: [24.961219]  [ 24.961245] ? mt76_connac_mcu_add_key+0x2cf/0x310 [ 24.961313] ? mt7921_set_key+0x150/0x200 [ 24.961365] ? drv_set_key+0xa9/0x1b0 [ 24.961418] ? ieee80211_key_enable_hw_accel+0xd9/0x240 [ 24.961485] ? ieee80211_key_replace+0x3f3/0x730 [ 24.961541] ? crypto_shash_setkey+0x89/0xd0 [ 24.961597] ? ieee80211_key_link+0x2d7/0x3a0 [ 24.961664] ? crypto_aead_setauthsize+0x31/0x50 [ 24.961730] ? sta_info_hash_lookup+0xa6/0xf0 [ 24.961785] ? ieee80211_add_key+0x1fc/0x250 [ 24.961842] ? rdev_add_key+0x41/0x140 [ 24.961882] ? nl80211_parse_key+0x6c/0x2f0 [ 24.961940] ? nl80211_new_key+0x24a/0x290 [ 24.961984] ? genl_rcv_msg+0x36c/0x3a0 [ 24.962036] ? rdev_mod_link_station+0xe0/0xe0 [ 24.962102] ? nl80211_set_key+0x410/0x410 [ 24.962143] ? nl80211_pre_doit+0x200/0x200 [ 24.962187] ? genl_bind+0xc0/0xc0 [ 24.962217] ? netlink_rcv_skb+0xaa/0xd0 [ 24.962259] ? genl_rcv+0x24/0x40 [ 24.962300] ? netlink_unicast+0x224/0x2f0 [ 24.962345] ? netlink_sendmsg+0x30b/0x3d0 [ 24.962388] ? ____sys_sendmsg+0x109/0x1b0 [ 24.962388] ? ____sys_sendmsg+0x109/0x1b0 [ 24.962440] ? __import_iovec+0x2e/0x110 [ 24.962482] ? ___sys_sendmsg+0xbe/0xe0 [ 24.962525] ? mod_objcg_state+0x25c/0x330 [ 24.962576] ? __dentry_kill+0x19e/0x1d0 [ 24.962618] ? call_rcu+0x18f/0x270 [ 24.962660] ? __dentry_kill+0x19e/0x1d0 [ 24.962702] ? __x64_sys_sendmsg+0x70/0x90 [ 24.962744] ? do_syscall_64+0x3d/0x80 [ 24.962796] ? exit_to_user_mode_prepare+0x1b/0x70 [ 24.962852] ? entry_SYSCA ---truncado---"
          }
        ],
        "id": "CVE-2023-53086",
        "lastModified": "2026-08-04T10:18:54.333",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-05-02T16:15:27.580",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/53edfda851dd1ce41ac049ce2f195dc41dd27cc1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5683e1488aa9b0805a9403d215e48fed29d6d923"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:20:54+00:00",
      "cve": "CVE-2023-53086",
      "id": "CVE-2023-53086",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "120",
      "product_status:known_affected": "124",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mt76: connac: do not check WED status for non-mmio devices",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53086.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.