Bluetooth Vulnerability in Linux Kernel Affecting HCI Devices

CVE-2023-53520

What is CVE-2023-53520?

A vulnerability in the Linux kernel's Bluetooth subsystem can lead to crashes when the hci_dev object is improperly handled. In scenarios where hci_unregister_dev() frees the object, concurrent access by hci_suspend_notifier may cause a crash. To mitigate this risk, a patch was implemented to maintain the reference count of the hci_dev object during processing in hci_suspend_notifier, preventing potential race conditions.

References