CVE-2023-53827

Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}

State: Published
Severity: 8.8 High
Published: Dec 9, 2025
Updated: Oct 15, 2026
Reserved: Dec 9, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}

Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to prevent referencing a channel that is about to be destroyed.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before f2d38e77aa5f3effc143e7dd24da8acf02925958Affected 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before 1351551aa9058e07a20a27a158270cf84fcde621Affected 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before c02421992505c95c7f3c9ad59ee35e22eac60988Affected 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before d9ba36c22a7bb09d6bac4cc2f243eff05da53f43Affected 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before ac6725a634f7e8c0330610a8527f20c730b61115Affected 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before 348d446762e7c70778df8bafbdf3fa0df2123f58Affected 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before d82a439c3cfdb28aa7e82e2e849c5c4dd9fca284Affected 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before a2a9339e1c9deb7e1e079e12e27a0265aea8421aAffected
LinuxLinux	3.5Affected before 3.5Not affected 4.14.313 through 4.14.Not affected 4.19.281 through 4.19.Not affected 5.4.241 through 5.4.Not affected 5.10.178 through 5.10.Not affected 5.15.108 through 5.15.Not affected 6.1.25 through 6.1.Not affected 6.2.12 through 6.2.*Not affected 6.3 and laterNot affected

Product

Versions

LinuxLinux

61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before f2d38e77aa5f3effc143e7dd24da8acf02925958Affected
61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before 1351551aa9058e07a20a27a158270cf84fcde621Affected
61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before c02421992505c95c7f3c9ad59ee35e22eac60988Affected
61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before d9ba36c22a7bb09d6bac4cc2f243eff05da53f43Affected
61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before ac6725a634f7e8c0330610a8527f20c730b61115Affected
61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before 348d446762e7c70778df8bafbdf3fa0df2123f58Affected
61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before d82a439c3cfdb28aa7e82e2e849c5c4dd9fca284Affected
61d6ef3e3408cdf7e622646fb90a9f7f9560b943 to before a2a9339e1c9deb7e1e079e12e27a0265aea8421aAffected

LinuxLinux

3.5Affected
before 3.5Not affected
4.14.313 through 4.14.*Not affected
4.19.281 through 4.19.*Not affected
5.4.241 through 5.4.*Not affected
5.10.178 through 5.10.*Not affected
5.15.108 through 5.15.*Not affected
6.1.25 through 6.1.*Not affected
6.2.12 through 6.2.*Not affected
6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.