linux-cve-announce - CVE-2023-53827: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025120952-CVE-2023-53827-b045@gregkh>
Date: Tue,  9 Dec 2025 10:31:11 +0900
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53827: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}

Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free
caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to
prevent referencing a channel that is about to be destroyed.

The Linux kernel CVE team has assigned CVE-2023-53827 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.14.313 with commit f2d38e77aa5f3effc143e7dd24da8acf02925958
	Fixed in 4.19.281 with commit 1351551aa9058e07a20a27a158270cf84fcde621
	Fixed in 5.4.241 with commit c02421992505c95c7f3c9ad59ee35e22eac60988
	Fixed in 5.10.178 with commit d9ba36c22a7bb09d6bac4cc2f243eff05da53f43
	Fixed in 5.15.108 with commit ac6725a634f7e8c0330610a8527f20c730b61115
	Fixed in 6.1.25 with commit 348d446762e7c70778df8bafbdf3fa0df2123f58
	Fixed in 6.2.12 with commit d82a439c3cfdb28aa7e82e2e849c5c4dd9fca284
	Fixed in 6.3 with commit a2a9339e1c9deb7e1e079e12e27a0265aea8421a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53827
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bluetooth/l2cap_core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f2d38e77aa5f3effc143e7dd24da8acf02925958
	https://git.kernel.org/stable/c/1351551aa9058e07a20a27a158270cf84fcde621
	https://git.kernel.org/stable/c/c02421992505c95c7f3c9ad59ee35e22eac60988
	https://git.kernel.org/stable/c/d9ba36c22a7bb09d6bac4cc2f243eff05da53f43
	https://git.kernel.org/stable/c/ac6725a634f7e8c0330610a8527f20c730b61115
	https://git.kernel.org/stable/c/348d446762e7c70778df8bafbdf3fa0df2123f58
	https://git.kernel.org/stable/c/d82a439c3cfdb28aa7e82e2e849c5c4dd9fca284
	https://git.kernel.org/stable/c/a2a9339e1c9deb7e1e079e12e27a0265aea8421a