Log in Start free

Vulnerability · Published May 2, 2025 · Assigned by Linux

CVE-2023-53046Bluetooth: Fix race condition in hci_cmd_sync_clear

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.1%top 96.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hci_cmd_sync_clear There is a potential race condition in hci_cmd_sync_work and hci_cmd_sync_clear, and could lead to use-after-free. For instance, hci_cmd_sync_work is added to the 'req_workqueue' after cancel_work_sync The entry of 'cmd_sync_work_list' may be freed in hci_cmd_sync_clear, and causing kernel panic when it is used in 'hci_cmd_sync_work'. Here's the call trace: dump_stack_lvl+0x49/0x63 print_report.cold+0x5e/0x5d3 ? hci_cmd_sync_work+0x282/0x320 kasan_report+0xaa/0x120 ? hci_cmd_sync_work+0x282/0x320 __asan_report_load8_noabort+0x14/0x20 hci_cmd_sync_work+0x282/0x320 process_one_work+0x77b/0x11c0 ? _raw_spin_lock_irq+0x8e/0xf0 worker_thread+0x544/0x1180 ? poll_idle+0x1e0/0x1e0 kthread+0x285/0x320 ? process_one_work+0x11c0/0x11c0 ? kthread_complete_and_exit+0x30/0x30 ret_from_fork+0x22/0x30 </TASK> Allocated by task 266: kasan_save_stack+0x26/0x50 __kasan_kmalloc+0xae/0xe0 kmem_cache_alloc_trace+0x191/0x350 hci_cmd_sync_queue+0x97/0x2b0 hci_update_passive_scan+0x176/0x1d0 le_conn_complete_evt+0x1b5/0x1a00 hci_le_conn_complete_evt+0x234/0x340 hci_le_meta_evt+0x231/0x4e0 hci_event_packet+0x4c5/0xf00 hci_rx_work+0x37d/0x880 process_one_work+0x77b/0x11c0 worker_thread+0x544/0x1180 kthread+0x285/0x320 ret_from_fork+0x22/0x30 Freed by task 269: kasan_save_stack+0x26/0x50 kasan_set_track+0x25/0x40 kasan_set_free_info+0x24/0x40 ____kasan_slab_free+0x176/0x1c0 __kasan_slab_free+0x12/0x20 slab_free_freelist_hook+0x95/0x1a0 kfree+0xba/0x2f0 hci_cmd_sync_clear+0x14c/0x210 hci_unregister_dev+0xff/0x440 vhci_release+0x7b/0xf0 __fput+0x1f3/0x970 ____fput+0xe/0x20 task_work_run+0xd4/0x160 do_exit+0x8b0/0x22a0 do_group_exit+0xba/0x2a0 get_signal+0x1e4a/0x25b0 arch_do_signal_or_restart+0x93/0x1f80 exit_to_user_mode_prepare+0xf5/0x1a0 syscall_exit_to_user_mode+0x26/0x50 ret_from_fork+0x15/0x30

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.25-1DEBIAN-CVE-2023-53046
Debian:13linux6.1.25-1DEBIAN-CVE-2023-53046
Debian:14linux6.1.25-1DEBIAN-CVE-2023-53046
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2023-53046
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-53046
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2023-53046
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2023-53046

Affected products (as reported)

VendorProductVersions
Linux Linux 6a98e3836fa2077b169f10a35c2ca9952d53f987 – before 608901a77c945ac15dea23f6098c9882ef19d9f06a98e3836fa2077b169f10a35c2ca9952d53f987 – before be586211a3ab40a4f4ca60450e0d31606afc55ec6a98e3836fa2077b169f10a35c2ca9952d53f987 – before 1c66bee492a5fe00ae3fe890bb693bfc99f994c6
Linux Linux 5.17

References