In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()
nl80211_parse_mbssid_elems() uses a u8 variable num_elems to count the
number of MBSSID elements in the nested netlink attribute attrs, which can
lead to an integer overflow if a user of the nl80211 interface specifies
256 or more elements in the corresponding attribute in userspace. The
integer overflow can lead to a heap buffer overflow as num_elems determines
the size of the trailing array in elems, and this array is thereafter
written to for each element in attrs.
Note that this vulnerability only affects devices with the
wiphy->mbssid_max_interfaces member set for the wireless physical device
struct in the device driver, and can only be triggered by a process with
CAP_NET_ADMIN capabilities.
Fix this by checking for a maximum of 255 elements in attrs.
References
Configurations
Configuration 1 (hide)
|
History
06 Feb 2026, 14:56
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux
Linux linux Kernel |
|
| CWE | CWE-190 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CPE | cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.5:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/6311071a056272e1e761de8d0305e87cc566f734 - Patch | |
| References | () https://git.kernel.org/stable/c/7d09f9f255a5f78578deba5454923072bb53b16c - Patch | |
| References | () https://git.kernel.org/stable/c/e642eb67b8c10dcce758d549cc81564116e0fa49 - Patch |
04 Oct 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-04 16:15
Updated : 2026-02-06 14:56
NVD link : CVE-2023-53570
Mitre link : CVE-2023-53570
CVE.ORG link : CVE-2023-53570
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-190
Integer Overflow or Wraparound