Cloudanix VulnDB

CVE-2023-53673

High · 7.8

CVSS

7.8

EPSS

0.3%

Published

Oct 7, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's Bluetooth handling can let a local user crash the system or potentially gain elevated access, fixed by updating to a newer kernel version.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in hci_cs_disconnect allows ISO/L2CAP/SCO sockets to retain references to a freed hci_conn object when a disconnect command fails, resulting in NULL pointer dereference or slab-use-after-free on subsequent send operations.

Why it matters to the business

Kernel panics or potential local privilege escalation on Linux systems with Bluetooth enabled; low exploit probability but requires prompt patching across fleets to avoid instability, especially in container or embedded environments.

How an attack unfolds

An attacker with local access initiates a Bluetooth connection, forces a disconnect command that returns a failure status, then continues socket operations on the dangling references left by ISO/L2CAP/SCO layers before the callback can clean up state.

How to fix it

Upgrade the Linux kernel to the commit 1ecf6dc2676ead4b927c50b1be0851fa4d756574 or later stable releases that ensure the disconnect callback is invoked before hci_conn_del.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source, verify no Bluetooth-related use-after-free reports under failed disconnect scenarios, and test socket cleanup paths after simulated disconnect failures.

Typical attack path

  1. Obtain local access on a Bluetooth-enabled Linux system
  2. Establish ISO, L2CAP or SCO connection via Bluetooth sockets
  3. Issue disconnect that returns error status 0x0c
  4. Perform send or other operations on the socket after hci_conn_del
  5. Trigger use-after-free leading to crash or memory corruption

How to detect it

Review kernel logs for Bluetooth HCI disconnect status errors followed by NULL pointer dereferences or KASAN reports in iso_sock_sendmsg, l2cap_chan_send or hci_send_acl; correlate with bluetoothd process activity and socket operations after failed disconnects.

What your security team should do

  • Prioritize kernel updates on all systems exposing Bluetooth interfaces
  • Monitor EPSS trend and any new exploit reports given the 387-day window since publication
  • Disable Bluetooth where not required as a temporary mitigation
  • Include the fixed commit hash in automated kernel build and deployment pipelines

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: call disconnect callback before deleting conn In hci_cs_disconnect, we do hci_conn_del even if disconnection failed. ISO, L2CAP and SCO connections refer to the hci_conn without hci_conn_get, so disconn_cfm must be called so they can clean up their conn, otherwise use-after-free occurs. ISO: ========================================================== iso_sock_connect:880: sk 00000000eabd6557 iso_connect_cis:356: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da ... iso_conn_add:140: hcon 000000001696f1fd conn 00000000b6251073 hci_dev_put:1487: hci0 orig refcnt 17 __iso_chan_add:214: conn 00000000b6251073 iso_sock_clear_timer:117: sock 00000000eabd6557 state 3 ... hci_rx_work:4085: hci0 Event packet hci_event_packet:7601: hci0: event 0x0f hci_cmd_status_evt:4346: hci0: opcode 0x0406 hci_cs_disconnect:2760: hci0: status 0x0c hci_sent_cmd_data:3107: hci0 opcode 0x0406 hci_conn_del:1151: hci0 hcon 000000001696f1fd handle 2560 hci_conn_unlink:1102: hci0: hcon 000000001696f1fd hci_conn_drop:1451: hcon 00000000d8521aaf orig refcnt 2 hci_chan_list_flush:2780: hcon 000000001696f1fd hci_dev_put:1487: hci0 orig refcnt 21 hci_dev_put:1487: hci0 orig refcnt 20 hci_req_cmd_complete:3978: opcode 0x0406 status 0x0c ... <no iso_* activity on sk/conn> ... iso_sock_sendmsg:1098: sock 00000000dea5e2e0, sk 00000000eabd6557 BUG: kernel NULL pointer dereference, address: 0000000000000668 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:iso_sock_sendmsg (net/bluetooth/iso.c:1112) bluetooth ========================================================== L2CAP: ================================================================== hci_cmd_status_evt:4359: hci0: opcode 0x0406 hci_cs_disconnect:2760: hci0: status 0x0c hci_sent_cmd_data:3085: hci0 opcode 0x0406 hci_conn_del:1151: hci0 hcon ffff88800c999000 handle 3585 hci_conn_unlink:1102: hci0: hcon ffff88800c999000 hci_chan_list_flush:2780: hcon ffff88800c999000 hci_chan_del:2761: hci0 hcon ffff88800c999000 chan ffff888018ddd280 ... BUG: KASAN: slab-use-after-free in hci_send_acl+0x2d/0x540 [bluetooth] Read of size 8 at addr ffff888018ddd298 by task bluetoothd/1175 CPU: 0 PID: 1175 Comm: bluetoothd Tainted: G E 6.4.0-rc4+ #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5b/0x90 print_report+0xcf/0x670 ? __virt_addr_valid+0xf8/0x180 ? hci_send_acl+0x2d/0x540 [bluetooth] kasan_report+0xa8/0xe0 ? hci_send_acl+0x2d/0x540 [bluetooth] hci_send_acl+0x2d/0x540 [bluetooth] ? __pfx___lock_acquire+0x10/0x10 l2cap_chan_send+0x1fd/0x1300 [bluetooth] ? l2cap_sock_sendmsg+0xf2/0x170 [bluetooth] ? __pfx_l2cap_chan_send+0x10/0x10 [bluetooth] ? lock_release+0x1d5/0x3c0 ? mark_held_locks+0x1a/0x90 l2cap_sock_sendmsg+0x100/0x170 [bluetooth] sock_write_iter+0x275/0x280 ? __pfx_sock_write_iter+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 do_iter_readv_writev+0x176/0x220 ? __pfx_do_iter_readv_writev+0x10/0x10 ? find_held_lock+0x83/0xa0 ? selinux_file_permission+0x13e/0x210 do_iter_write+0xda/0x340 vfs_writev+0x1b4/0x400 ? __pfx_vfs_writev+0x10/0x10 ? __seccomp_filter+0x112/0x750 ? populate_seccomp_data+0x182/0x220 ? __fget_light+0xdf/0x100 ? do_writev+0x19d/0x210 do_writev+0x19d/0x210 ? __pfx_do_writev+0x10/0x10 ? mark_held_locks+0x1a/0x90 do_syscall_64+0x60/0x90 ? lockdep_hardirqs_on_prepare+0x149/0x210 ? do_syscall_64+0x6c/0x90 ? lockdep_hardirqs_on_prepare+0x149/0x210 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7ff45cb23e64 Code: 15 d1 1f 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 80 3d 9d a7 0d 00 00 74 13 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 RSP: 002b:00007fff21ae09b8 EFLAGS: 00000202 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: ---truncated---

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 bpftool 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-abi-stablelists 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-core 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-cross-headers 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-debug 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-debug-core 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-debug-devel 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-debug-modules 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-debug-modules-extra 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-devel 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-doc 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-headers 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-modules 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-modules-extra 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-rt 0 4.18.0-553.97.1.rt7.438.el8_10
AlmaLinux:8 kernel-rt-core 0 4.18.0-553.97.1.rt7.438.el8_10
AlmaLinux:8 kernel-rt-debug 0 4.18.0-553.97.1.rt7.438.el8_10
AlmaLinux:8 kernel-rt-debug-core 0 4.18.0-553.97.1.rt7.438.el8_10
AlmaLinux:8 kernel-rt-debug-devel 0 4.18.0-553.97.1.rt7.438.el8_10
AlmaLinux:8 kernel-rt-debug-modules 0 4.18.0-553.97.1.rt7.438.el8_10
AlmaLinux:8 kernel-rt-debug-modules-extra 0 4.18.0-553.97.1.rt7.438.el8_10
AlmaLinux:8 kernel-rt-devel 0 4.18.0-553.97.1.rt7.438.el8_10
AlmaLinux:8 kernel-rt-modules 0 4.18.0-553.97.1.rt7.438.el8_10
AlmaLinux:8 kernel-rt-modules-extra 0 4.18.0-553.97.1.rt7.438.el8_10
AlmaLinux:8 kernel-tools 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-tools-libs 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-tools-libs-devel 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-zfcpdump 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-zfcpdump-core 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-zfcpdump-devel 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-zfcpdump-modules 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 kernel-zfcpdump-modules-extra 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 perf 0 4.18.0-553.97.1.el8_10
AlmaLinux:8 python3-perf 0 4.18.0-553.97.1.el8_10
Linux Kernel 5.7.0 5.15.200
Linux Kernel 5.7.0 6.1.42
SUSE:Linux Enterprise High Availability Extension 15 SP6 kernel-default 0 6.4.0-150600.23.78.1
SUSE:Linux Enterprise High Availability Extension 15 SP7 kernel-default 0 6.4.0-150700.53.22.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-64kb 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-default 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-default-base 0 5.14.21-150500.55.127.1.150500.6.61.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-docs 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-obs-build 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-source 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-syms 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-64kb 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-default 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-default-base 0 5.14.21-150500.55.127.1.150500.6.61.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-docs 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-obs-build 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-source 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-syms 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Live Patching 15 SP3 kernel-livepatch-SLE15-SP3_Update_50 0 18-150300.2.1
SUSE:Linux Enterprise Live Patching 15 SP3 kernel-livepatch-SLE15-SP3_Update_59 0 9-150300.2.1
SUSE:Linux Enterprise Live Patching 15 SP3 kernel-livepatch-SLE15-SP3_Update_60 0 6-150300.2.1
SUSE:Linux Enterprise Live Patching 15 SP3 kernel-livepatch-SLE15-SP3_Update_62 0 2-150300.2.1
SUSE:Linux Enterprise Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_34 0 17-150400.2.1
SUSE:Linux Enterprise Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_39 0 10-150400.2.1
SUSE:Linux Enterprise Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_42 0 8-150400.2.1
SUSE:Linux Enterprise Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_45 0 2-150400.2.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-default 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_32 0 1-150500.11.3.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-default 0 6.4.0-150600.23.78.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_17 0 1-150600.1.3.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_17 0 1-150600.13.5.1
SUSE:Linux Enterprise Live Patching 15 SP7 kernel-default 0 6.4.0-150700.53.22.1
SUSE:Linux Enterprise Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_6 0 1-150700.15.3.1
SUSE:Linux Enterprise Micro 5.2 kernel-rt 0 5.3.18-150300.226.1
SUSE:Linux Enterprise Micro 5.2 kernel-source-rt 0 5.3.18-150300.226.1
SUSE:Linux Enterprise Micro 5.5 kernel-default 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Micro 5.5 kernel-default-base 0 5.14.21-150500.55.127.1.150500.6.61.1
SUSE:Linux Enterprise Micro 5.5 kernel-source 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-64kb 0 6.4.0-150600.23.78.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default 0 6.4.0-150600.23.78.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default-base 0 6.4.0-150600.23.78.1.150600.12.34.2
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-source 0 6.4.0-150600.23.78.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-zfcpdump 0 6.4.0-150600.23.78.1
SUSE:Linux Enterprise Module for Basesystem 15 SP7 kernel-64kb 0 6.4.0-150700.53.22.1
SUSE:Linux Enterprise Module for Basesystem 15 SP7 kernel-default 0 6.4.0-150700.53.22.1
SUSE:Linux Enterprise Module for Basesystem 15 SP7 kernel-default-base 0 6.4.0-150700.53.22.1.150700.17.15.1
SUSE:Linux Enterprise Module for Basesystem 15 SP7 kernel-source 0 6.4.0-150700.53.22.1
SUSE:Linux Enterprise Module for Basesystem 15 SP7 kernel-zfcpdump 0 6.4.0-150700.53.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-docs 0 6.4.0-150600.23.78.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-obs-build 0 6.4.0-150600.23.78.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-source 0 6.4.0-150600.23.78.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-syms 0 6.4.0-150600.23.78.1
SUSE:Linux Enterprise Module for Development Tools 15 SP7 kernel-docs 0 6.4.0-150700.53.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP7 kernel-obs-build 0 6.4.0-150700.53.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP7 kernel-source 0 6.4.0-150700.53.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP7 kernel-syms 0 6.4.0-150700.53.22.1
SUSE:Linux Enterprise Module for Legacy 15 SP6 kernel-default 0 6.4.0-150600.23.78.1
SUSE:Linux Enterprise Module for Legacy 15 SP7 kernel-default 0 6.4.0-150700.53.22.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-azure 0 6.4.0-150600.8.55.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-source-azure 0 6.4.0-150600.8.55.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-syms-azure 0 6.4.0-150600.8.55.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP7 kernel-azure 0 6.4.0-150700.20.18.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP7 kernel-source-azure 0 6.4.0-150700.20.18.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP7 kernel-syms-azure 0 6.4.0-150700.20.18.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-64kb 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-default 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-default-base 0 5.14.21-150500.55.127.1.150500.6.61.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-docs 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-obs-build 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-source 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-syms 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-zfcpdump 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 kernel-default 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 kernel-default-base 0 5.14.21-150500.55.127.1.150500.6.61.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 kernel-docs 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 kernel-obs-build 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 kernel-source 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 kernel-syms 0 5.14.21-150500.55.127.1
SUSE:Linux Enterprise Workstation Extension 15 SP6 kernel-default 0 6.4.0-150600.23.78.1
SUSE:Linux Enterprise Workstation Extension 15 SP7 kernel-default 0 6.4.0-150700.53.22.1
SUSE:Real Time Module 15 SP6 kernel-rt 0 6.4.0-150600.10.58.1
SUSE:Real Time Module 15 SP6 kernel-rt_debug 0 6.4.0-150600.10.58.1
SUSE:Real Time Module 15 SP6 kernel-source-rt 0 6.4.0-150600.10.58.1
SUSE:Real Time Module 15 SP6 kernel-syms-rt 0 6.4.0-150600.10.58.1
openSUSE:Leap 15.6 dtb-aarch64 0 6.4.0-150600.23.78.1
openSUSE:Leap 15.6 kernel-64kb 0 6.4.0-150600.23.78.1
openSUSE:Leap 15.6 kernel-azure 0 6.4.0-150600.8.55.1
openSUSE:Leap 15.6 kernel-debug 0 6.4.0-150600.23.78.1
openSUSE:Leap 15.6 kernel-default 0 6.4.0-150600.23.78.1
openSUSE:Leap 15.6 kernel-default-base 0 6.4.0-150600.23.78.1.150600.12.34.2
openSUSE:Leap 15.6 kernel-docs 0 6.4.0-150600.23.78.1
openSUSE:Leap 15.6 kernel-kvmsmall 0 6.4.0-150600.23.78.1
openSUSE:Leap 15.6 kernel-obs-build 0 6.4.0-150600.23.78.1
openSUSE:Leap 15.6 kernel-obs-qa 0 6.4.0-150600.23.78.1
openSUSE:Leap 15.6 kernel-rt 0 6.4.0-150600.10.58.1
openSUSE:Leap 15.6 kernel-rt_debug 0 6.4.0-150600.10.58.1
openSUSE:Leap 15.6 kernel-source 0 6.4.0-150600.23.78.1
openSUSE:Leap 15.6 kernel-source-azure 0 6.4.0-150600.8.55.1
openSUSE:Leap 15.6 kernel-source-rt 0 6.4.0-150600.10.58.1
openSUSE:Leap 15.6 kernel-syms 0 6.4.0-150600.23.78.1
openSUSE:Leap 15.6 kernel-syms-azure 0 6.4.0-150600.8.55.1
openSUSE:Leap 15.6 kernel-syms-rt 0 6.4.0-150600.10.58.1
openSUSE:Leap 15.6 kernel-zfcpdump 0 6.4.0-150600.23.78.1

Related vulnerabilities