CVE-2023-54029 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: fix iwl_mvm_max_amsdu_size() for MLO
For MLO, we cannot use vif->bss_conf.chandef.chan->band, since that will lead to a NULL-ptr dereference as bss_conf isn't used. However, in case of real MLO, we also need to take both LMACs into account if they exist, since the station might be active on both LMACs at the same time.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/27/2026
The vulnerability in question affects the iwlwifi wireless driver within the Linux kernel, specifically addressing issues related to Multi-Link Operation (MLO) support in Intel wireless network adapters. This flaw represents a critical null pointer dereference condition that could potentially lead to system instability or denial of service scenarios when handling MLO configurations. The root cause stems from improper handling of channel definition structures during MLO station operations, where the driver attempts to access bss_conf.chandef.chan->band without proper validation of the bss_conf structure itself.
The technical implementation flaw occurs within the iwl_mvm_max_amsdu_size() function which is responsible for determining the maximum AMSDU size for wireless transmissions. In MLO environments, the driver incorrectly assumes that vif->bss_conf.chandef.chan->band will always contain valid data, but this assumption fails when bss_conf is not utilized in MLO configurations. The absence of proper null pointer checks creates a scenario where accessing chandef.chan->band directly leads to kernel crashes or undefined behavior, particularly affecting systems running modern wireless protocols that support multi-link operations.
This vulnerability impacts the operational integrity of wireless networking capabilities on Linux systems, especially those utilizing Intel wireless adapters in MLO environments. The flaw affects devices that support concurrent operation across multiple links simultaneously, potentially disrupting network connectivity and causing system instability during active wireless sessions. Attackers could exploit this condition to induce denial of service by triggering specific wireless configuration scenarios that activate the null pointer dereference path, making it particularly concerning for enterprise and infrastructure deployments where reliable wireless connectivity is critical.
The mitigation strategy involves implementing proper validation checks before accessing bss_conf.chandef.chan->band in MLO contexts, ensuring that the function correctly handles cases where bss_conf may be NULL or when multiple LMACs are present. This requires modifying the iwl_mvm_max_amsdu_size() implementation to properly account for both LMACs when they exist, as mentioned in the patch description, while maintaining backward compatibility with traditional single-link configurations. The fix aligns with security best practices for kernel development and addresses common CWE categories related to improper null pointer dereferences and insufficient input validation.
From an ATT&CK perspective, this vulnerability could be leveraged in privilege escalation or denial of service attacks within wireless networking contexts, particularly affecting systems that rely on Intel wireless drivers for network operations. The fix demonstrates proper defensive programming practices that align with industry standards for kernel security, ensuring that wireless subsystems maintain stability and prevent unauthorized access to system resources through malformed wireless configuration data. This vulnerability resolution contributes to the overall security posture of Linux wireless infrastructure by preventing potential exploitation vectors in MLO-enabled wireless networks that are increasingly common in modern networking deployments.