{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2023-53305",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2023-53305"
  ],
  "published": "2025-09-16T16:13:45Z",
  "summary": "Bluetooth: L2CAP: Fix use-after-free",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free\n\nFix potential use-after-free in l2cap_le_command_rej.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.21-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v6",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v7",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v7l",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v8",
            "binary_version": "1:6.1.21-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.21-1+rpt1": {
            "linux_commit": "0afb5e98488aed7017b9bf321b575d0177feb7ed",
            "upstream_version": "6.1.21",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.47"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-53305"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/e76bab1b7afa580cd76362540fc37551ada4359b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1a40c56e8bff3e424724d78a9a6b3272dd8a371d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/fe49aa73cca6608714477b74bfc6874b9db979df"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2958cf9f805b9f0bdc4a761bf6ea281eb8d44f8e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/548a6b64b3c0688f01119a6fcccceb41f8c984e4"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/149daab45922ab1ac7f0cbeacab7251a46bf5e63"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/255be68150291440657b2cdb09420b69441af3d8"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f752a0b334bb95fe9b42ecb511e0864e2768046f"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:24:39Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 8.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:A - The vulnerable path is reached when a Bluetooth LE peer sends an L2CAP Command Reject on the LE signaling CID (hci_rx_work \u2192 l2cap_recv_acldata \u2192 l2cap_le_sig_channel \u2192 l2cap_le_command_rej), which requires adjacency on the Bluetooth radio segment.\nAC:L - An attacker who is the LE peer can send COMMAND_REJ with the ident from a pending LE CoC request and reliably hit the missing hold/put window; no conditions beyond the attacker's control are required.\nPR:N - LE ACL/L2CAP signaling is processed for an established HCI LE connection with no pairing, encryption, or local capability check before l2cap_le_command_rej runs.\nUI:N - Exploitation only needs an LE link and a matching pending channel ident; no additional victim action is required at exploit time once the stack is in that normal operational state.\nS:U - Impact is confined to the local kernel Bluetooth/L2CAP authority (memory corruption / privilege escalation on the host), with no cross-boundary escape.\nC:H - This is a use-after-free of struct l2cap_chan; UAF enables heap reuse and arbitrary kernel read primitives.\nI:H - The same UAF enables heap spraying and arbitrary write / control-flow hijacking in kernel context.\nA:H - Dereferencing the freed channel (e.g., in l2cap_chan_unlock after l2cap_chan_del) can oops/panic the kernel even without full exploitation."
    }
  }
}