---
id: CVE-2023-53827
title: 'Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}

  Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free
  caused by l2cap_chan_put"), ju…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 <
    f2d38e77aa5f3effc143e7dd24da8acf02925958
  - >-
    Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 <
    1351551aa9058e07a20a27a158270cf84fcde621
  - >-
    Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 <
    c02421992505c95c7f3c9ad59ee35e22eac60988
  - >-
    Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 <
    d9ba36c22a7bb09d6bac4cc2f243eff05da53f43
  - >-
    Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 <
    ac6725a634f7e8c0330610a8527f20c730b61115
  - >-
    Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 <
    348d446762e7c70778df8bafbdf3fa0df2123f58
  - >-
    Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 <
    d82a439c3cfdb28aa7e82e2e849c5c4dd9fca284
  - >-
    Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 <
    a2a9339e1c9deb7e1e079e12e27a0265aea8421a
  - Linux 3.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:37:31.724293Z'
published: '2025-12-09'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:41:37.002Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53827'
references:
  - url: 'https://git.kernel.org/stable/c/f2d38e77aa5f3effc143e7dd24da8acf02925958'
  - url: 'https://git.kernel.org/stable/c/1351551aa9058e07a20a27a158270cf84fcde621'
  - url: 'https://git.kernel.org/stable/c/c02421992505c95c7f3c9ad59ee35e22eac60988'
  - url: 'https://git.kernel.org/stable/c/d9ba36c22a7bb09d6bac4cc2f243eff05da53f43'
  - url: 'https://git.kernel.org/stable/c/ac6725a634f7e8c0330610a8527f20c730b61115'
  - url: 'https://git.kernel.org/stable/c/348d446762e7c70778df8bafbdf3fa0df2123f58'
  - url: 'https://git.kernel.org/stable/c/d82a439c3cfdb28aa7e82e2e849c5c4dd9fca284'
  - url: 'https://git.kernel.org/stable/c/a2a9339e1c9deb7e1e079e12e27a0265aea8421a'
tags:
  - cve.org
epss: 0.00391
epssPercentile: 0.31477
ingestedAt: '2026-10-15T22:48:25.423Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}

Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free
caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to
prevent referencing a channel that is about to be destroyed.

## Affected

- `Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < f2d38e77aa5f3effc143e7dd24da8acf02925958`
- `Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < 1351551aa9058e07a20a27a158270cf84fcde621`
- `Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < c02421992505c95c7f3c9ad59ee35e22eac60988`
- `Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < d9ba36c22a7bb09d6bac4cc2f243eff05da53f43`
- `Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < ac6725a634f7e8c0330610a8527f20c730b61115`
- `Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < 348d446762e7c70778df8bafbdf3fa0df2123f58`
- `Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < d82a439c3cfdb28aa7e82e2e849c5c4dd9fca284`
- `Linux >= 61d6ef3e3408cdf7e622646fb90a9f7f9560b943 < a2a9339e1c9deb7e1e079e12e27a0265aea8421a`
- `Linux 3.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.