CVE-2023-53017

Bluetooth: hci_sync: fix memory leak in hci_update_adv_data()

State: Published
Severity: 5.5 Medium
Published: Mar 27, 2025
Updated: May 11, 2026
Reserved: Mar 27, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: fix memory leak in hci_update_adv_data()

When hci_cmd_sync_queue() failed in hci_update_adv_data(), inst_ptr is not freed, which will cause memory leak, convert to use ERR_PTR/PTR_ERR to pass the instance to callback so no memory needs to be allocated.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	651cd3d65b0f76a2198fcf3a80ce5d53dd267717 to before 8ac6043bd3e5b58d30f50737aedc2e58e8087ad5Affected 651cd3d65b0f76a2198fcf3a80ce5d53dd267717 to before 1ed8b37cbaf14574c779064ef1372af62e8ba6aaAffected
LinuxLinux	6.1Affected before 6.1Not affected 6.1.9 through 6.1.*Not affected 6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.