CVE-2023-54197

What it actually does

The revert reintroduces a potential null pointer dereference in btsdio_remove within the Linux kernel Bluetooth SDIO driver by removing race-condition protections around unfinished work.

Why it matters to the business

Linux systems using Bluetooth over SDIO may experience kernel crashes or instability, disrupting device availability and any dependent services or operations.

How an attack unfolds

An attacker with local access triggers Bluetooth device removal under timing conditions that expose the null pointer dereference introduced by the reverted commit, resulting in a kernel panic.

How to fix it

Upgrade the Linux kernel to a fixed version such as 4.14.315 or apply commit 3b4ed52009723f7dfca7a8ca95163bfb441bfb76 (or equivalent stable backports) that resolves the null-ptr-deref.

How to confirm the fix worked

Confirm the running kernel version matches a listed fixed release or verify the presence of the resolving commit in the kernel source tree.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Trigger btsdio_remove via Bluetooth SDIO device removal under race conditions
3. Hit the null pointer dereference causing kernel oops or panic

How to detect it

Search kernel logs and crash dumps for oops or panic messages referencing btsdio_remove or null pointer dereference in the Bluetooth SDIO driver path.

• btsdio_remove
• null-ptr-deref
• Bluetooth SDIO kernel panic

What your security team should do

• Prioritize kernel updates to patched versions across all affected systems
• Temporarily disable unused Bluetooth SDIO interfaces as a mitigation
• Monitor kernel logs for Bluetooth-related oops and panics until patches are deployed