CVE-2023-53016

Bluetooth: Fix possible deadlock in rfcomm_sk_state_change

State: Published
Severity: 5.5 Medium
Published: Mar 27, 2025
Updated: May 11, 2026
Reserved: Mar 27, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix possible deadlock in rfcomm_sk_state_change

syzbot reports a possible deadlock in rfcomm_sk_state_change [1]. While rfcomm_sock_connect acquires the sk lock and waits for the rfcomm lock, rfcomm_sock_release could have the rfcomm lock and hit a deadlock for acquiring the sk lock. Here's a simplified flow:

rfcomm_sock_connect: lock_sock(sk) rfcomm_dlc_open: rfcomm_lock()

rfcomm_sock_release: rfcomm_sock_shutdown: rfcomm_lock() __rfcomm_dlc_close: rfcomm_k_state_change: lock_sock(sk)

This patch drops the sk lock before calling rfcomm_dlc_open to avoid the possible deadlock and holds sk's reference count to prevent use-after-free after rfcomm_dlc_open completes.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-667 Improper Locking

Affected Products

Product	Versions
LinuxLinux	1804fdf6e494e5e2938c65d8391690b59bcff897 to before 98aec50ff7f60cc6f2d6a4396b475c547e58b04dAffected 1804fdf6e494e5e2938c65d8391690b59bcff897 to before 17511bd84871f4a6106cb335616e086880313f3fAffected 1804fdf6e494e5e2938c65d8391690b59bcff897 to before 1d80d57ffcb55488f0ec0b77928d4f82d16b6a90Affected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.91 through 5.15.Not affected 6.1.9 through 6.1.Not affected 6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.