---
id: CVE-2023-54210
title: 'Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()

  KASAN reports that there's a use-after-free in
  hci_remove_adv_monitor(). Trawling through…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c <
    0d4d6b083da9b033ddccef72d77f373c819ae3ea
  - >-
    Linux >= 7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c <
    bf00c2c8f6254f44ac041aa9a311ae9e0caf692b
  - >-
    Linux >= 7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c <
    de6dfcefd107667ce2dbedf4d9337f5ed557a4a1
  - Linux 6.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:39:22.862450Z'
published: '2025-12-30'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:41:41.692Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-54210'
references:
  - url: 'https://git.kernel.org/stable/c/0d4d6b083da9b033ddccef72d77f373c819ae3ea'
  - url: 'https://git.kernel.org/stable/c/bf00c2c8f6254f44ac041aa9a311ae9e0caf692b'
  - url: 'https://git.kernel.org/stable/c/de6dfcefd107667ce2dbedf4d9337f5ed557a4a1'
tags:
  - cve.org
epss: 0.00148
epssPercentile: 0.03615
ingestedAt: '2026-10-15T22:48:25.434Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()

KASAN reports that there's a use-after-free in
hci_remove_adv_monitor(). Trawling through the disassembly, you can
see that the complaint is from the access in bt_dev_dbg() under the
HCI_ADV_MONITOR_EXT_MSFT case. The problem case happens because
msft_remove_monitor() can end up freeing the monitor
structure. Specifically:
  hci_remove_adv_monitor() ->
  msft_remove_monitor() ->
  msft_remove_monitor_sync() ->
  msft_le_cancel_monitor_advertisement_cb() ->
  hci_free_adv_monitor()

Let's fix the problem by just stashing the relevant data when it's
still valid.

## Affected

- `Linux >= 7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c < 0d4d6b083da9b033ddccef72d77f373c819ae3ea`
- `Linux >= 7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c < bf00c2c8f6254f44ac041aa9a311ae9e0caf692b`
- `Linux >= 7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c < de6dfcefd107667ce2dbedf4d9337f5ed557a4a1`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.