Use After Free Vulnerability in Linux Kernel Bluetooth Implementation

CVE-2023-53145

What is CVE-2023-53145?

A use after free vulnerability has been identified in the Linux kernel's Bluetooth subsystem, particularly affecting the btsdio implementation. This issue arises from a race condition in the btsdio_remove function, where the associated work, bound to btsdio_work, is not canceled before the cleanup process. If btsdio_remove is executed while the work is still pending, it can lead to referencing a freed memory segment, potentially causing unpredictable behavior and system instability. The vulnerability has been addressed in recent kernel updates.

References