CVE-2023-53762Expired Pointer Dereference in Linux

Severity
7.0HIGH
No vector
EPSS
0.0%
top 90.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 8

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync Use-after-free can occur in hci_disconnect_all_sync if a connection is deleted by concurrent processing of a controller event. To prevent this the code now tries to iterate over the list backwards to ensure the links are cleanup before its parents, also it no longer relies on a cursor, instead it always uses the last element since hci_abort_conn_sync is guaranteed to cal

Affected Packages4 packages

Linuxlinux/linux_kernel5.17.06.4.16+1
Debianlinux/linux_kernel< 6.5.3-1+1
CVEListV5linux/linux182ee45da083db4e3e621541ccf255bfa9652214a30c074f0b5b7f909a15c978fbc96a29e2f94e42+3
debiandebian/linux< linux 6.5.3-1 (forky)

🔴Vulnerability Details

3
GHSA
GHSA-v6x6-vgmm-x298: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync Use-after-free can occur2025-12-08
OSV
Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync2025-12-08
OSV
CVE-2023-53762: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync Use-after-free can occur i2025-12-08

📋Vendor Advisories

2
Red Hat
kernel: Linux kernel Bluetooth: Denial of Service due to use-after-free in connection handling2025-12-08
Debian
CVE-2023-53762: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ...2023