CVE-2023-53827
published 2025-12-09CVE-2023-53827: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} Similar to commit…
PriorityP343high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.39%
32.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free
caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to
prevent referencing a channel that is about to be destroyed.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.25-1 (bookworm) | linux 6.1.25-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < f2d38e77aa5f3effc143e7dd24da8acf02925958 | f2d38e77aa5f3effc143e7dd24da8acf02925958 |
| linux | linux | >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < 1351551aa9058e07a20a27a158270cf84fcde621 | 1351551aa9058e07a20a27a158270cf84fcde621 |
| linux | linux | >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < c02421992505c95c7f3c9ad59ee35e22eac60988 | c02421992505c95c7f3c9ad59ee35e22eac60988 |
| linux | linux | >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < d9ba36c22a7bb09d6bac4cc2f243eff05da53f43 | d9ba36c22a7bb09d6bac4cc2f243eff05da53f43 |
| linux | linux | >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < ac6725a634f7e8c0330610a8527f20c730b61115 | ac6725a634f7e8c0330610a8527f20c730b61115 |
| linux | linux | >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < 348d446762e7c70778df8bafbdf3fa0df2123f58 | 348d446762e7c70778df8bafbdf3fa0df2123f58 |
| linux | linux | >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < d82a439c3cfdb28aa7e82e2e849c5c4dd9fca284 | d82a439c3cfdb28aa7e82e2e849c5c4dd9fca284 |
| linux | linux | >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < a2a9339e1c9deb7e1e079e12e27a0265aea8421a | a2a9339e1c9deb7e1e079e12e27a0265aea8421a |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 3.5.0 < 4.14.313 | 4.14.313 |
| linux | linux_kernel | >= 4.15.0 < 4.19.281 | 4.19.281 |
| linux | linux_kernel | >= 4.20.0 < 5.4.241 | 5.4.241 |
| linux | linux_kernel | >= 5.11.0 < 5.15.108 | 5.15.108 |
| linux | linux_kernel | >= 5.16.0 < 6.1.25 | 6.1.25 |
| linux | linux_kernel | >= 5.5.0 < 5.10.178 | 5.10.178 |
| linux | linux_kernel | >= 6.2.0 < 6.2.12 | 6.2.12 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-53827: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} Similar to comm
osv·2025-12-09
CVE-2023-53827 CVE-2023-53827: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} Similar to comm
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to prevent referencing a channel that is about to be destroyed.
OSV
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
osv·2025-12-09
CVE-2023-53827 Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free
caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to
prevent referencing a channel that is about to be destroyed.
GHSA
GHSA-gvg6-6cf6-h6vq: In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
Similar to co
ghsa_unreviewed·2025-12-09
CVE-2023-53827 GHSA-gvg6-6cf6-h6vq: In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
Similar to co
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free
caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to
prevent referencing a channel that is about to be destroyed.
Red Hat
kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
vendor_redhat·2025-12-09·CVSS 7.5
CVE-2023-53827 [MEDIUM] CWE-416 kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free
caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to
prevent referencing a channel that is about to be destroyed.
Statement: A race in the L2CAP disconnect request/response handlers could access a channel that is being destroyed, causing a use-after-free and kernel crash. The fix uses l2cap_chan_hold_unless_zero() and proper locking around channel deletion to avoid referencing freed objects. An adjacent attacker over Bluetooth can trigger this during disconnect handling on an active link. Likely on
Debian
CVE-2023-53827: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ...
vendor_debian·2023
CVE-2023-53827 CVE-2023-53827: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ...
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to prevent referencing a channel that is about to be destroyed.
Scope: local
bookworm: resolved (fixed in 6.1.25-1)
bullseye: resolved (fixed in 5.10.178-1)
forky: resolved (fixed in 6.1.25-1)
sid: resolved (fixed in 6.1.25-1)
trixie: resolved (fixed in 6.1.25-1)
No detection rules found.
No public exploits indexed.
Wiz
CVE-2023-53827 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2023-53827 CVE-2023-53827 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2023-53827 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free
caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to
prevent referencing a channel that is about to be destroyed.
Source : NVD
Published December 9, 2025
CNA Score N/A
Affected Technologies
Linux Kernel
Linux Debian
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 10.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
kernel-debug-modules
kernel-rt-64k-debug
Sources
NVD
Debian 1
Bugzilla
CVE-2023-53827 kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
bugzilla·2025-12-09
CVE-2023-53827 [MEDIUM] CVE-2023-53827 kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
CVE-2023-53827 kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free
caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to
prevent referencing a channel that is about to be destroyed.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025120952-CVE-2023-53827-b045@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Via RHSA-2026:3360 https://access.redhat.com/errata/
https://git.kernel.org/stable/c/1351551aa9058e07a20a27a158270cf84fcde621https://git.kernel.org/stable/c/348d446762e7c70778df8bafbdf3fa0df2123f58https://git.kernel.org/stable/c/a2a9339e1c9deb7e1e079e12e27a0265aea8421ahttps://git.kernel.org/stable/c/ac6725a634f7e8c0330610a8527f20c730b61115https://git.kernel.org/stable/c/c02421992505c95c7f3c9ad59ee35e22eac60988https://git.kernel.org/stable/c/d82a439c3cfdb28aa7e82e2e849c5c4dd9fca284https://git.kernel.org/stable/c/d9ba36c22a7bb09d6bac4cc2f243eff05da53f43https://git.kernel.org/stable/c/f2d38e77aa5f3effc143e7dd24da8acf02925958
2025-12-09
Published