CVE-2023-53679

A flaw of moderate severity was found in the mt7601u USB wireless driver in the Linux kernel as shipped in Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9 (kernel and kernel-rt). When processing received USB Request Block (URB) data, the driver fails to ensure that the dma_len field is greater than the minimum segment length; a manipulated dma_len value causes an integer underflow of seg_len in mt7601u_rx_process_seg(), which bypasses the bad_frame validation in mt7601u_rx_skb_from_seg() and results in a null-pointer dereference. An attacker able to supply crafted URB receive data with manipulated packet lengths can therefore crash the kernel, causing a denial of service; no confidentiality or integrity impact is expected. The fix is currently deferred for the affected Red Hat Enterprise Linux 8 and 9 update streams; since the demonstrated impact is limited to availability, the residual risk of deferral is a system crash on systems that process crafted mt7601u receive data. Red Hat Enterprise Linux 6, 7, and 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those products. Red Hat's Moderate rating (CVSS 6.5) differs from the upstream CVE record's Important rating (CVSS 8.3, which includes confidentiality and integrity impacts) because the verified technical evidence demonstrates only a null-pointer dereference leading to a system crash.