# CVE-2023-53822: linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath11k: Ignore frags from uninitialized pe...

CVE-2023-53822 is fixed in linux on 1 platform, first by DEBIAN-CVE-2023-53822, released December 9, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-53822
- Priority: High
- CVSS: 8.8 (high)
- EPSS: 0.0038
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Dec 9, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  wifi: ath11k: Ignore frags from uninitialized peer in dp.  When max virtual ap interfaces are configured in all the bands with ACS and hostapd restart is done every 60s, a crash is observed at random times. In this certain scenario, a fragmented packet is received for self peer, for which rx_tid and rx_frags are not initialized in datapath. While handling this fragment, crash is observed as the rx_frag list is uninitialised and when we walk in ath11k_dp_rx_h_sort_frags, skb null leads to exception.  To address this, before processing received fragments we check dp_setup_done flag is set to ensure that peer has completed its dp peer setup for fragment queue, else ignore processing the fragments.  Call trace:   ath11k_dp_process_rx_err+0x550/0x1084 [ath11k]   ath11k_dp_service_srng+0x70/0x370 [ath11k]   0xffffffc009693a04   __napi_poll+0x30/0xa4   net_rx_action+0x118/0x270   __do_softirq+0x10c/0x244   irq_exit+0x64/0xb4   __handle_domain_irq+0x88/0xac   gic_handle_irq+0x74/0xbc   el1_irq+0xf0/0x1c0   arch_cpu_idle+0x10/0x18   do_idle+0x104/0x248   cpu_startup_entry+0x20/0x64   rest_init+0xd0/0xdc   arch_call_rest_init+0xc/0x14   start_kernel+0x480/0x4b8   Code: f9400281 f94066a2 91405021 b94a0023 (f9406401)  Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.37-1 | [DEBIAN-CVE-2023-53822](https://patchblox.com/security/data/fix/linux/debian-cve-2023-53822.md) | Dec 9, 2025 |
| Linux | linux Debian 13.5 (trixie) | 6.3.7-1 | [DEBIAN-CVE-2023-53822](https://patchblox.com/security/data/fix/linux/debian-cve-2023-53822.md) | Dec 9, 2025 |
| Linux | linux Debian 14 | 6.3.7-1 | [DEBIAN-CVE-2023-53822](https://patchblox.com/security/data/fix/linux/debian-cve-2023-53822.md) | Dec 9, 2025 |

---

Data as of 2026-11-10T01:44:33Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.