{"id":"CVE-2023-54210","title":"Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()\n\nKASAN reports that there's a use-after-free in\nhci_remove_adv_monitor(). Trawling through…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c < 0d4d6b083da9b033ddccef72d77f373c819ae3ea","Linux >= 7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c < bf00c2c8f6254f44ac041aa9a311ae9e0caf692b","Linux >= 7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c < de6dfcefd107667ce2dbedf4d9337f5ed557a4a1","Linux 6.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:39:22.862450Z"},"published":"2025-12-30","updated":"2026-10-15","sourceUpdated":"2026-10-15T21:41:41.692Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-54210","references":[{"url":"https://git.kernel.org/stable/c/0d4d6b083da9b033ddccef72d77f373c819ae3ea"},{"url":"https://git.kernel.org/stable/c/bf00c2c8f6254f44ac041aa9a311ae9e0caf692b"},{"url":"https://git.kernel.org/stable/c/de6dfcefd107667ce2dbedf4d9337f5ed557a4a1"}],"tags":["cve.org"],"epss":0.00148,"epssPercentile":0.03615,"ingestedAt":"2026-10-15T22:48:25.434Z","slug":"CVE-2023-54210","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()\n\nKASAN reports that there's a use-after-free in\nhci_remove_adv_monitor(). Trawling through the disassembly, you can\nsee that the complaint is from the access in bt_dev_dbg() under the\nHCI_ADV_MONITOR_EXT_MSFT case. The problem case happens because\nmsft_remove_monitor() can end up freeing the monitor\nstructure. Specifically:\n  hci_remove_adv_monitor() ->\n  msft_remove_monitor() ->\n  msft_remove_monitor_sync() ->\n  msft_le_cancel_monitor_advertisement_cb() ->\n  hci_free_adv_monitor()\n\nLet's fix the problem by just stashing the relevant data when it's\nstill valid.\n\n## Affected\n\n- `Linux >= 7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c < 0d4d6b083da9b033ddccef72d77f373c819ae3ea`\n- `Linux >= 7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c < bf00c2c8f6254f44ac041aa9a311ae9e0caf692b`\n- `Linux >= 7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c < de6dfcefd107667ce2dbedf4d9337f5ed557a4a1`\n- `Linux 6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}