In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9khtctxstatus()
Fix an array-index-out-of-bounds read in ath9khtctxstatus(). The bug occurs when txs->cnt, data from a URB provided by a USB device, is bigger than the size of the array txs->txstatus, which is HTCMAXTXSTATUS. WARNON() already checks it, but there is no bug handling code after the check. Make the function return if that is the case.
Found by a modified version of syzkaller.
UBSAN: array-index-out-of-bounds in htcdrvtxrx.c index 13 is out of range for type '_wmieventtxstatus [12]' Call Trace: ath9khtctxstatus ath9kwmieventtasklet taskletactioncommon _dosoftirq irqexitrxu sysvecapictimer_interrupt
[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f11f0fd1ad6c11ae7856d4325fe9d05059767225",
        "target": {
            "function": "ath9k_htc_txstatus",
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-06ae2bf8",
        "signature_type": "Function",
        "digest": {
            "length": 654.0,
            "function_hash": "47351139179663428102248970413176462147"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be609c7002dd4504b15b069cb7582f4c778548d1",
        "target": {
            "function": "ath9k_htc_txstatus",
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-25f95225",
        "signature_type": "Function",
        "digest": {
            "length": 654.0,
            "function_hash": "47351139179663428102248970413176462147"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2adc886244dff60f948497b59affb6c6ebb3c348",
        "target": {
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-38a53c38",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "248861351685514305798886675279177449417",
                "100912026702296961317441549724315346365",
                "254472524727907811155148239105890506281",
                "14453743282544535284924694470364379804",
                "277100932592317206534647667412077141112"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25c6f49ef59b7a9b80a3f7ab9e95268a1b01a234",
        "target": {
            "function": "ath9k_htc_txstatus",
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-4a9fb067",
        "signature_type": "Function",
        "digest": {
            "length": 654.0,
            "function_hash": "47351139179663428102248970413176462147"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25c6f49ef59b7a9b80a3f7ab9e95268a1b01a234",
        "target": {
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-510ae78e",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "248861351685514305798886675279177449417",
                "100912026702296961317441549724315346365",
                "254472524727907811155148239105890506281",
                "14453743282544535284924694470364379804",
                "277100932592317206534647667412077141112"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84770a996ad8d7f121ff2fb5a8d149aad52d64c1",
        "target": {
            "function": "ath9k_htc_txstatus",
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-588b1594",
        "signature_type": "Function",
        "digest": {
            "length": 654.0,
            "function_hash": "47351139179663428102248970413176462147"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be609c7002dd4504b15b069cb7582f4c778548d1",
        "target": {
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-5f74467e",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "248861351685514305798886675279177449417",
                "100912026702296961317441549724315346365",
                "254472524727907811155148239105890506281",
                "14453743282544535284924694470364379804",
                "277100932592317206534647667412077141112"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4f4bac7d3b64eb75f70cd3345712de6f68a215d",
        "target": {
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-84cb7794",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "248861351685514305798886675279177449417",
                "100912026702296961317441549724315346365",
                "254472524727907811155148239105890506281",
                "14453743282544535284924694470364379804",
                "277100932592317206534647667412077141112"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84770a996ad8d7f121ff2fb5a8d149aad52d64c1",
        "target": {
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-9d367a0b",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "248861351685514305798886675279177449417",
                "100912026702296961317441549724315346365",
                "254472524727907811155148239105890506281",
                "14453743282544535284924694470364379804",
                "277100932592317206534647667412077141112"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f11f0fd1ad6c11ae7856d4325fe9d05059767225",
        "target": {
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-b7fa0429",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "248861351685514305798886675279177449417",
                "100912026702296961317441549724315346365",
                "254472524727907811155148239105890506281",
                "14453743282544535284924694470364379804",
                "277100932592317206534647667412077141112"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f44f073c78112ff921a220d01b86d09f2ace59bc",
        "target": {
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-c4810272",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "248861351685514305798886675279177449417",
                "100912026702296961317441549724315346365",
                "254472524727907811155148239105890506281",
                "14453743282544535284924694470364379804",
                "277100932592317206534647667412077141112"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9003fa9a0198ce004b30738766c67eb7373479c9",
        "target": {
            "function": "ath9k_htc_txstatus",
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-c9c4403c",
        "signature_type": "Function",
        "digest": {
            "length": 654.0,
            "function_hash": "47351139179663428102248970413176462147"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9003fa9a0198ce004b30738766c67eb7373479c9",
        "target": {
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-dc8ab3f0",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "248861351685514305798886675279177449417",
                "100912026702296961317441549724315346365",
                "254472524727907811155148239105890506281",
                "14453743282544535284924694470364379804",
                "277100932592317206534647667412077141112"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f44f073c78112ff921a220d01b86d09f2ace59bc",
        "target": {
            "function": "ath9k_htc_txstatus",
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-e8dd9ae9",
        "signature_type": "Function",
        "digest": {
            "length": 654.0,
            "function_hash": "47351139179663428102248970413176462147"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4f4bac7d3b64eb75f70cd3345712de6f68a215d",
        "target": {
            "function": "ath9k_htc_txstatus",
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-ec90f5e3",
        "signature_type": "Function",
        "digest": {
            "length": 654.0,
            "function_hash": "47351139179663428102248970413176462147"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2adc886244dff60f948497b59affb6c6ebb3c348",
        "target": {
            "function": "ath9k_htc_txstatus",
            "file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52594-f06dac25",
        "signature_type": "Function",
        "digest": {
            "length": 654.0,
            "function_hash": "47351139179663428102248970413176462147"
        }
    }
]