CVE-2023-54214
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix potential user-after-free This fixes all instances of which requires to allocate a buffer calling alloc_skb which may release the chan lock and reacquire later which makes it possible that the chan is disconnected in the meantime.
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Deferred
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-12-30 13:16:09.633000
Last modified
2026-10-28 19:10:00.193000
View original CVE JSON
{
"id": "CVE-2023-54214",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-12-30T13:16:09.633",
"lastModified": "2026-10-28T19:10:00.193",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix potential user-after-free\n\nThis fixes all instances of which requires to allocate a buffer calling\nalloc_skb which may release the chan lock and reacquire later which\nmakes it possible that the chan is disconnected in the meantime."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: L2CAP: Corrección de posible uso después de liberación\n\nEsto corrige todas las instancias de que requiere asignar un búfer llamando a alloc_skb, que puede liberar el bloqueo del canal y readquirirlo más tarde, lo que hace posible que el canal se desconecte mientras tanto."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"net/bluetooth/l2cap_core.c",
"net/bluetooth/l2cap_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "a6a5568c03c4805d4d250f6bd9d468eeeb4ea059",
"lessThan": "b2fde8cb2a25125111f2144604e0e7c0ebcc4bba",
"versionType": "git",
"status": "affected"
},
{
"version": "a6a5568c03c4805d4d250f6bd9d468eeeb4ea059",
"lessThan": "a6a7d1541fefddf7ca0cfb34c1bff63ff809cc49",
"versionType": "git",
"status": "affected"
},
{
"version": "a6a5568c03c4805d4d250f6bd9d468eeeb4ea059",
"lessThan": "60aaccf16d1e099c16bebfb96428ae762cb528f7",
"versionType": "git",
"status": "affected"
},
{
"version": "a6a5568c03c4805d4d250f6bd9d468eeeb4ea059",
"lessThan": "b8ed41cc04fb74005aa51d17865ca3d022760335",
"versionType": "git",
"status": "affected"
},
{
"version": "a6a5568c03c4805d4d250f6bd9d468eeeb4ea059",
"lessThan": "31a288a4df7f6a28e65da22a4ab2add4a963738e",
"versionType": "git",
"status": "affected"
},
{
"version": "a6a5568c03c4805d4d250f6bd9d468eeeb4ea059",
"lessThan": "64e28ecf44e46de9f01915a4146706a21c3469d2",
"versionType": "git",
"status": "affected"
},
{
"version": "a6a5568c03c4805d4d250f6bd9d468eeeb4ea059",
"lessThan": "994e3e18908f5c4a12d07b44018e6aa85f071048",
"versionType": "git",
"status": "affected"
},
{
"version": "a6a5568c03c4805d4d250f6bd9d468eeeb4ea059",
"lessThan": "df5703348813235874d851934e957c3723d71644",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"net/bluetooth/l2cap_core.c",
"net/bluetooth/l2cap_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "3.5",
"status": "affected"
},
{
"version": "0",
"lessThan": "3.5",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "4.14.308",
"lessThanOrEqual": "4.14.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "4.19.276",
"lessThanOrEqual": "4.19.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.4.235",
"lessThanOrEqual": "5.4.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.173",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.99",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.16",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.2.3",
"lessThanOrEqual": "6.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-15T21:39:26.318408Z",
"id": "CVE-2023-54214",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/31a288a4df7f6a28e65da22a4ab2add4a963738e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/60aaccf16d1e099c16bebfb96428ae762cb528f7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/64e28ecf44e46de9f01915a4146706a21c3469d2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/994e3e18908f5c4a12d07b44018e6aa85f071048",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a6a7d1541fefddf7ca0cfb34c1bff63ff809cc49",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b2fde8cb2a25125111f2144604e0e7c0ebcc4bba",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b8ed41cc04fb74005aa51d17865ca3d022760335",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/df5703348813235874d851934e957c3723d71644",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}