Riskcovery

CVE-2023-53520

Bluetooth: Fix hci_suspend_sync crash

State
Published
Severity
7.8 High
Published
Oct 1, 2025
Updated
Oct 15, 2026
Reserved
Oct 1, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix hci_suspend_sync crash

If hci_unregister_dev() frees the hci_dev object but hci_suspend_notifier may still be accessing it, it can cause the program to crash. Here's the call trace: <4>[102152.653246] Call Trace: <4>[102152.653254] hci_suspend_sync+0x109/0x301 [bluetooth] <4>[102152.653259] hci_suspend_dev+0x78/0xcd [bluetooth] <4>[102152.653263] hci_suspend_notifier+0x42/0x7a [bluetooth] <4>[102152.653268] notifier_call_chain+0x43/0x6b <4>[102152.653271] __blocking_notifier_call_chain+0x48/0x69 <4>[102152.653273] __pm_notifier_call_chain+0x22/0x39 <4>[102152.653276] pm_suspend+0x287/0x57c <4>[102152.653278] state_store+0xae/0xe5 <4>[102152.653281] kernfs_fop_write+0x109/0x173 <4>[102152.653284] __vfs_write+0x16f/0x1a2 <4>[102152.653287] ? selinux_file_permission+0xca/0x16f <4>[102152.653289] ? security_file_permission+0x36/0x109 <4>[102152.653291] vfs_write+0x114/0x21d <4>[102152.653293] __x64_sys_write+0x7b/0xdb <4>[102152.653296] do_syscall_64+0x59/0x194 <4>[102152.653299] entry_SYSCALL_64_after_hwframe+0x5c/0xc1

This patch holds the reference count of the hci_dev object while processing it in hci_suspend_notifier to avoid potential crash caused by the race condition.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 9952d90ea2885d7cbf80cd233f694f09a9c0eaec to before e1fa25a91091bbed691ba2996a6cee809e3309a2Affected
  • 9952d90ea2885d7cbf80cd233f694f09a9c0eaec to before 06e2b5ad72b60f90bfe565c201346532e271f484Affected
  • 9952d90ea2885d7cbf80cd233f694f09a9c0eaec to before f9c8ce5d665653e3cf71a76349d41d7a7f7947e6Affected
  • 9952d90ea2885d7cbf80cd233f694f09a9c0eaec to before 573ebae162111063eedc6c838a659ba628f66a0fAffected
LinuxLinux
  • 5.7Affected
  • before 5.7Not affected
  • 5.15.199 through 5.15.*Not affected
  • 6.1.55 through 6.1.*Not affected
  • 6.5.5 through 6.5.*Not affected
  • 6.6 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.