Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2023-53673— Bluetooth: hci_event: call disconnect callback before deleting conn

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未在删除连接前调用断开回调，可能导致释放后重用。

CVSS 8.8 · High EPSS 0.24% · P15 Updated Aug 05, 2026

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 10

Vendor	Product	Version Range	Status
Linux	Linux	`b8d290525e3972b5e876b2649a42bf4081d753fe< 1ecf6dc2676ead4b927c50b1be0851fa4d756574`	affected
		`b8d290525e3972b5e876b2649a42bf4081d753fe< 59bd1e476bbc7bc6dff3c61bba787095a4839796`	affected
		`b8d290525e3972b5e876b2649a42bf4081d753fe< 093a07052406b363b1b2ab489e17dbadaf3e509b`	affected
		`b8d290525e3972b5e876b2649a42bf4081d753fe< 7f7cfcb6f0825652973b780f248603e23f16ee90`	affected
		`5.7`	affected
		`< 5.7`	unaffected
		`5.15.200≤ 5.15.*`	unaffected
		`6.1.42≤ 6.1.*`	unaffected
… +2 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-53673

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Bluetooth: hci_event: call disconnect callback before deleting conn

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: call disconnect callback before deleting conn In hci_cs_disconnect, we do hci_conn_del even if disconnection failed. ISO, L2CAP and SCO connections refer to the hci_conn without hci_conn_get, so disconn_cfm must be called so they can clean up their conn, otherwise use-after-free occurs. ISO: ========================================================== iso_sock_connect:880: sk 00000000eabd6557 iso_connect_cis:356: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da ... iso_conn_add:140: hcon 000000001696f1fd conn 00000000b6251073 hci_dev_put:1487: hci0 orig refcnt 17 __iso_chan_add:214: conn 00000000b6251073 iso_sock_clear_timer:117: sock 00000000eabd6557 state 3 ... hci_rx_work:4085: hci0 Event packet hci_event_packet:7601: hci0: event 0x0f hci_cmd_status_evt:4346: hci0: opcode 0x0406 hci_cs_disconnect:2760: hci0: status 0x0c hci_sent_cmd_data:3107: hci0 opcode 0x0406 hci_conn_del:1151: hci0 hcon 000000001696f1fd handle 2560 hci_conn_unlink:1102: hci0: hcon 000000001696f1fd hci_conn_drop:1451: hcon 00000000d8521aaf orig refcnt 2 hci_chan_list_flush:2780: hcon 000000001696f1fd hci_dev_put:1487: hci0 orig refcnt 21 hci_dev_put:1487: hci0 orig refcnt 20 hci_req_cmd_complete:3978: opcode 0x0406 status 0x0c ... <no iso_* activity on sk/conn> ... iso_sock_sendmsg:1098: sock 00000000dea5e2e0, sk 00000000eabd6557 BUG: kernel NULL pointer dereference, address: 0000000000000668 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:iso_sock_sendmsg (net/bluetooth/iso.c:1112) bluetooth ========================================================== L2CAP: ================================================================== hci_cmd_status_evt:4359: hci0: opcode 0x0406 hci_cs_disconnect:2760: hci0: status 0x0c hci_sent_cmd_data:3085: hci0 opcode 0x0406 hci_conn_del:1151: hci0 hcon ffff88800c999000 handle 3585 hci_conn_unlink:1102: hci0: hcon ffff88800c999000 hci_chan_list_flush:2780: hcon ffff88800c999000 hci_chan_del:2761: hci0 hcon ffff88800c999000 chan ffff888018ddd280 ... BUG: KASAN: slab-use-after-free in hci_send_acl+0x2d/0x540 [bluetooth] Read of size 8 at addr ffff888018ddd298 by task bluetoothd/1175 CPU: 0 PID: 1175 Comm: bluetoothd Tainted: G E 6.4.0-rc4+ #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5b/0x90 print_report+0xcf/0x670 ? __virt_addr_valid+0xf8/0x180 ? hci_send_acl+0x2d/0x540 [bluetooth] kasan_report+0xa8/0xe0 ? hci_send_acl+0x2d/0x540 [bluetooth] hci_send_acl+0x2d/0x540 [bluetooth] ? __pfx___lock_acquire+0x10/0x10 l2cap_chan_send+0x1fd/0x1300 [bluetooth] ? l2cap_sock_sendmsg+0xf2/0x170 [bluetooth] ? __pfx_l2cap_chan_send+0x10/0x10 [bluetooth] ? lock_release+0x1d5/0x3c0 ? mark_held_locks+0x1a/0x90 l2cap_sock_sendmsg+0x100/0x170 [bluetooth] sock_write_iter+0x275/0x280 ? __pfx_sock_write_iter+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 do_iter_readv_writev+0x176/0x220 ? __pfx_do_iter_readv_writev+0x10/0x10 ? find_held_lock+0x83/0xa0 ? selinux_file_permission+0x13e/0x210 do_iter_write+0xda/0x340 vfs_writev+0x1b4/0x400 ? __pfx_vfs_writev+0x10/0x10 ? __seccomp_filter+0x112/0x750 ? populate_seccomp_data+0x182/0x220 ? __fget_light+0xdf/0x100 ? do_writev+0x19d/0x210 do_writev+0x19d/0x210 ? __pfx_do_writev+0x10/0x10 ? mark_held_locks+0x1a/0x90 do_syscall_64+0x60/0x90 ? lockdep_hardirqs_on_prepare+0x149/0x210 ? do_syscall_64+0x6c/0x90 ? lockdep_hardirqs_on_prepare+0x149/0x210 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7ff45cb23e64 Code: 15 d1 1f 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 80 3d 9d a7 0d 00 00 74 13 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 RSP: 002b:00007fff21ae09b8 EFLAGS: 00000202 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: ---truncated---

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	b8d290525e3972b5e876b2649a42bf4081d753fe ~ 1ecf6dc2676ead4b927c50b1be0851fa4d756574	-
Linux	Linux	5.7	-

II. Public POCs for CVE-2023-53673

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2023-53673

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2023-53673

Same Patch Batch · Linux · 2025-10-07 · 118 CVEs total

CVE-2023-53629	9.8 CRITICAL	fs: dlm: fix use after free in midcomms commit
CVE-2023-53630	8.8 HIGH	iommufd: Fix unpinning of pages when an access is present
CVE-2023-53676	8.8 HIGH	scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
CVE-2023-53675	8.8 HIGH	scsi: ses: Fix possible desc_ptr out-of-bounds accesses
CVE-2023-53679	8.3 HIGH	wifi: mt7601u: fix an integer underflow
CVE-2023-53635	8.2 HIGH	netfilter: conntrack: fix wrong ct->timeout value
CVE-2023-53659	7.8 HIGH	iavf: Fix out-of-bounds when setting channels on remove
CVE-2023-53619	7.8 HIGH	netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
CVE-2023-53660	7.8 HIGH	bpf, cpumap: Handle skb as well when clean up ptr_ring
CVE-2023-53643	7.8 HIGH	nvme-tcp: don't access released socket during error recovery
CVE-2023-53645	7.8 HIGH	bpf: Make bpf_refcount_acquire fallible for non-owning refs
CVE-2023-53646	7.8 HIGH	drm/i915/perf: add sentinel to xehp_oa_b_counters
CVE-2023-53669	7.8 HIGH	tcp: fix skb_copy_ubufs() vs BIG TCP
CVE-2023-53626	7.8 HIGH	ext4: fix possible double unlock when moving a directory
CVE-2022-50528	7.8 HIGH	drm/amdkfd: Fix memory leakage
CVE-2023-53627	7.8 HIGH	scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list
CVE-2022-50555	7.8 HIGH	tipc: fix a null-ptr-deref in tipc_topsrv_accept
CVE-2022-50518	7.8 HIGH	parisc: Fix locking in pdc_iodc_print() firmware call
CVE-2023-53683	7.8 HIGH	fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()
CVE-2022-50517	7.8 HIGH	mm/huge_memory: do not clobber swp_entry_t during THP split

Showing top 20 of 118 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2023-53673

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2023-53673— Bluetooth: hci_event: call disconnect callback before deleting conn

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 10

I. Basic Information for CVE-2023-53673

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2023-53673

III. Intelligence Information for CVE-2023-53673

Same Patch Batch · Linux · 2025-10-07 · 118 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2023-53673

Leave a comment