{"id":"CVE-2023-53828","title":"Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()\n\nKSAN reports use-after-free in hci_add_adv_monitor().\n\nWhile adding an adv monitor,\n    hci_…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= b747a83690c8f53bc7a3f75899415c699b2c51aa < 81d8e9f59df63b8358751c1ffed9f1cf5c796909","Linux >= b747a83690c8f53bc7a3f75899415c699b2c51aa < aafda69d4807f5edf3558c9534be9b911774e63a","Linux >= b747a83690c8f53bc7a3f75899415c699b2c51aa < 8d66f7ced51cb924bc90278d6a0a26a52877271a","Linux >= b747a83690c8f53bc7a3f75899415c699b2c51aa < a2bcd2b63271a93a695fabbfbf459c603d956d48","Linux 6.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:37:35.211467Z"},"published":"2025-12-09","updated":"2026-10-15","sourceUpdated":"2026-10-15T21:41:37.140Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-53828","references":[{"url":"https://git.kernel.org/stable/c/81d8e9f59df63b8358751c1ffed9f1cf5c796909"},{"url":"https://git.kernel.org/stable/c/aafda69d4807f5edf3558c9534be9b911774e63a"},{"url":"https://git.kernel.org/stable/c/8d66f7ced51cb924bc90278d6a0a26a52877271a"},{"url":"https://git.kernel.org/stable/c/a2bcd2b63271a93a695fabbfbf459c603d956d48"}],"tags":["cve.org"],"epss":0.00194,"epssPercentile":0.08453,"ingestedAt":"2026-10-15T22:48:25.424Z","slug":"CVE-2023-53828","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()\n\nKSAN reports use-after-free in hci_add_adv_monitor().\n\nWhile adding an adv monitor,\n    hci_add_adv_monitor() calls ->\n    msft_add_monitor_pattern() calls ->\n    msft_add_monitor_sync() calls ->\n    msft_le_monitor_advertisement_cb() calls in an error case ->\n    hci_free_adv_monitor() which frees the *moniter.\n\nThis is referenced by bt_dev_dbg() in hci_add_adv_monitor().\n\nFix the bt_dev_dbg() by using handle instead of monitor->handle.\n\n## Affected\n\n- `Linux >= b747a83690c8f53bc7a3f75899415c699b2c51aa < 81d8e9f59df63b8358751c1ffed9f1cf5c796909`\n- `Linux >= b747a83690c8f53bc7a3f75899415c699b2c51aa < aafda69d4807f5edf3558c9534be9b911774e63a`\n- `Linux >= b747a83690c8f53bc7a3f75899415c699b2c51aa < 8d66f7ced51cb924bc90278d6a0a26a52877271a`\n- `Linux >= b747a83690c8f53bc7a3f75899415c699b2c51aa < a2bcd2b63271a93a695fabbfbf459c603d956d48`\n- `Linux 6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}