{ "schema_version": "1.6.1", "id": "RPI-CVE-2023-53386", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2023-53386" ], "published": "2025-09-18T13:36:23Z", "summary": "Bluetooth: Fix potential use-after-free when clear keys", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix potential use-after-free when clear keys\n\nSimilar to commit c5d2b6fa26b5 (\"Bluetooth: Fix use-after-free in\nhci_remove_ltk/hci_remove_irk\"). We can not access k after kfree_rcu()\ncall.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.21-1+rpt1", "1:6.1.47-1+rpt2", "1:6.1.47-1+rpt4" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi1-rpi-v6", "binary_version": "1:6.1.21-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi1-rpi-v7", "binary_version": "1:6.1.21-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi1-rpi-v7l", "binary_version": "1:6.1.21-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi1-rpi-v8", "binary_version": "1:6.1.21-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi2-rpi-v6", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi2-rpi-v7", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi2-rpi-v7l", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi2-rpi-v8", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" } ] }, "database_specific": { "per_version": { "1:6.1.21-1+rpt1": { "linux_commit": "0afb5e98488aed7017b9bf321b575d0177feb7ed", "upstream_version": "6.1.21", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.53" }, "1:6.1.47-1+rpt2": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.53" }, "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.53", "compiled_filter": false } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2023-53386" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/e87da6a0ac6e631454e7da53a76aa9fe44aaa5dd" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/942d8cefb022f384d5424f8b90c7878f3f93726f" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/94617b736c25091b60e514e2e7aeafcbbee6b700" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/da19f35868dfbecfff4f81166c054d2656cb1be4" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/35cc42f04bc49f0656f6840cb7451b3df6049649" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/3673952cf0c6cf81b06c66a0b788abeeb02ff3ae" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T11:24:39Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - The UAF is reached via local AF_BLUETOOTH HCI_CHANNEL_CONTROL MGMT commands (LOAD_LINK_KEYS/LTKs/IRKs, SET_BLOCKED_KEYS) or hci_release_dev teardown; no over-the-air peer data drives the clear-keys path, matching prior mgmt.c scoring (e.g. CVE-2024-53208, CVE-2024-49951).\nAC:L - The attacker deterministically populates a key list then re-issues the same MGMT load/clear command (or tears down the adapter), and under PREEMPT the kfree_rcu\u2192list_next_entry window is attacker-retryable with a long key list and heap spray; no condition outside attacker control is required.\nPR:L - Trusted MGMT handlers require CAP_NET_ADMIN (HCI_SOCK_TRUSTED), which real deployments grant to non-root Bluetooth services (bluetoothd, Android AID_BLUETOOTH) rather than full root; consistent with prior CAP_NET_ADMIN-gated mgmt UAF scores.\nUI:N - The attacker issues the MGMT commands (or drives adapter teardown) entirely from its own process; no victim interaction is required.\nS:U - The use-after-free corrupts kernel heap within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free of sprayable kmalloc key objects (link_key/smp_ltk/smp_irk/blocked_key); after reclaim, reading the stale list next pointer and related fields yields an attacker-influenced kernel memory disclosure primitive.\nI:H - UAF of these heap objects enables heap grooming for write/control-flow hijack via corrupted list linkage and subsequent operations on attacker-controlled freed memory, per standard kernel UAF integrity scoring.\nA:H - Dereferencing freed key objects during list iteration reliably produces KASAN reports, oopses, or panics, and any use-after-free is scored High availability." } } }