CVE-2023-53374CWE-416

CVE-2023-53374

High · published September 18, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
11.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: fail SCO/ISO via hci_conn_failed if ACL gone early

Not calling hci_(dis)connect_cfm before deleting conn referred to by a

socket generally results to use-after-free.

When cleaning up SCO connections when the parent ACL is deleted too

early, use hci_conn_failed to do the connection cleanup properly.

We also need to clean up ISO connections in a similar situation when

connecting has started but LE Create CIS is not yet sent, so do it too

here.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.4th percentile
Weakness
CWE-416 · Use After Free
Published
2025-09-18T18:15Z
Affected products (8)
ProductVersionsFixed in
linux/linux_kernel≥ 6.3.8, < 6.46.4
linux/linux_kernel≥ 6.4.1, < 6.4.166.4.16
linux/linux_kernel≥ 6.5, < 6.5.36.5.3
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (3)
EPSS history
Timeline
  • 18 SEP 13:33Z
    Bluetooth: hci_conn: fail SCO/ISO via hci_conn_failed if ACL gone early
    cvelistv5