CVE-2023-23002

What it actually does

The driver treats an ERR_PTR return value from devm_gpiod_get_index_optional as a valid NULL descriptor, causing subsequent dereference of an error-encoded pointer and resulting in invalid memory access or kernel panic in the Qualcomm Bluetooth HCI path.

Why it matters to the business

Systems using affected Qualcomm Bluetooth hardware may suffer sudden kernel crashes or loss of Bluetooth functionality, leading to unplanned downtime on servers, laptops, and embedded devices running older kernels.

How an attack unfolds

A local attacker with user privileges triggers Bluetooth device probe or initialization on vulnerable hardware; the mis-handled error pointer is dereferenced during gpio acquisition, producing a kernel oops or denial of service. No widespread threat-actor campaigns are associated with this issue.

How to fix it

Upgrade the Linux kernel to 5.16.3 or newer; apply or cherry-pick commit 6845667146a28c09b5dfc401c1ad112374087944 in the hci_qca.c file. Rebuild, install, and reboot into the fixed kernel. Where live patching is available, apply the vendor's kpatch or ksplice equivalent.

How to confirm the fix worked

Confirm the running kernel version is 5.16.3 or later; verify the commit 6845667146a28c09b5dfc401c1ad112374087944 appears in the drivers/bluetooth/hci_qca.c history; attempt Bluetooth initialization on affected hardware and ensure no panic occurs.

Typical attack path

1. Obtain local shell or user access on the target system
2. Ensure a Qualcomm Bluetooth controller is present or emulated
3. Trigger hci_qca driver load or device registration
4. Force a gpio acquisition path that returns an error pointer instead of NULL
5. Observe kernel panic or system reboot

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages referencing hci_qca.c or devm_gpiod_get_index_optional around Bluetooth initialization timestamps; correlate with any unexpected reboots on systems that have Qualcomm Bluetooth controllers.

• hci_qca
• devm_gpiod_get_index_optional
• drivers/bluetooth/hci_qca.c

What your security team should do

• Immediately schedule kernel updates for all systems exposing Qualcomm Bluetooth hardware
• Add kernel version checks to vulnerability scanning and asset inventory
• Monitor vendor advisories for backported fixes in distribution kernels
• Review Bluetooth usage policies on high-availability systems until patches are applied