{
  "threat_severity" : "Moderate",
  "public_date" : "2025-10-01T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: wifi: rtw88: Fix memory leak in rtw88_usb",
    "id" : "2400736",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2400736"
  },
  "cvss3" : {
    "cvss3_base_score" : "4.4",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-772",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nwifi: rtw88: Fix memory leak in rtw88_usb\nKmemleak shows the following leak arising from routine in the usb\nprobe routine:\nunreferenced object 0xffff895cb29bba00 (size 512):\ncomm \"(udev-worker)\", pid 534, jiffies 4294903932 (age 102751.088s)\nhex dump (first 32 bytes):\n77 30 30 30 00 00 00 00 02 2f 2d 2b 30 00 00 00  w000...../-+0...\n02 00 2a 28 00 00 00 00 ff 55 ff ff ff 00 00 00  ..*(.....U......\nbacktrace:\n[<ffffffff9265fa36>] kmalloc_trace+0x26/0x90\n[<ffffffffc17eec41>] rtw_usb_probe+0x2f1/0x680 [rtw_usb]\n[<ffffffffc03e19fd>] usb_probe_interface+0xdd/0x2e0 [usbcore]\n[<ffffffff92b4f2fe>] really_probe+0x18e/0x3d0\n[<ffffffff92b4f5b8>] __driver_probe_device+0x78/0x160\n[<ffffffff92b4f6bf>] driver_probe_device+0x1f/0x90\n[<ffffffff92b4f8df>] __driver_attach+0xbf/0x1b0\n[<ffffffff92b4d350>] bus_for_each_dev+0x70/0xc0\n[<ffffffff92b4e51e>] bus_add_driver+0x10e/0x210\n[<ffffffff92b50935>] driver_register+0x55/0xf0\n[<ffffffffc03e0708>] usb_register_driver+0x88/0x140 [usbcore]\n[<ffffffff92401153>] do_one_initcall+0x43/0x210\n[<ffffffff9254f42a>] do_init_module+0x4a/0x200\n[<ffffffff92551d1c>] __do_sys_finit_module+0xac/0x120\n[<ffffffff92ee6626>] do_syscall_64+0x56/0x80\n[<ffffffff9300006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0\nThe leak was verified to be real by unloading the driver, which resulted\nin a dangling pointer to the allocation.\nThe allocated memory is freed in rtw_usb_intf_deinit()." ],
  "statement" : "The patch fixes a memory leak in the rtw88_usb driver by freeing rtwusb->usb_data in rtw_usb_intf_deinit(). Previously, allocations made during probe were not released on interface teardown, leading to leaked kernel memory reported by kmemleak.\nImpact is limited to availability (resource consumption) with no confidentiality or integrity effect. An attacker could only accumulate small leaks via repeated device (un)plug or privileged driver rebind cycles.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-53529\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-53529\nhttps://lore.kernel.org/linux-cve-announce/2025100136-CVE-2023-53529-db9a@gregkh/T" ],
  "name" : "CVE-2023-53529",
  "csaw" : false
}