PT-2025-41117 · Linux+4 · Linux Kernel+4
Published
2023-07-20
·
Updated
2026-04-20
·
CVE-2023-53673
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel contains a flaw in the Bluetooth implementation where the disconnect callback is called after the connection has been deleted. Specifically, in the
hci cs disconnect function, hci conn del is called even if disconnection fails. This can lead to a use-after-free condition in ISO and L2CAP connections, as they may reference the deleted hci conn without proper cleanup. This can result in kernel crashes, as demonstrated by reports of NULL pointer dereferences and slab-use-after-free errors during ISO and L2CAP operations. The issue occurs during Bluetooth disconnection handling.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Linux Kernel
Red Hat
Rocky Linux
Suse