{"id":"CVE-2023-54210","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()\n\nKASAN reports that there's a use-after-free in\nhci_remove_adv_monitor()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()\n\nKASAN reports that there's a use-after-free in\nhci_remove_adv_monitor(). Trawling through…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 6","enterprise_linux 9"],"published":"2025-12-30","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:17:55.287","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-54210","references":[{"url":"https://git.kernel.org/stable/c/0d4d6b083da9b033ddccef72d77f373c819ae3ea","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf00c2c8f6254f44ac041aa9a311ae9e0caf692b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de6dfcefd107667ce2dbedf4d9337f5ed557a4a1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54210.json"},{"url":"https://access.redhat.com/security/cve/CVE-2023-54210"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426229"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-54210"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54210"},{"url":"https://lore.kernel.org/linux-cve-announce/2025123024-CVE-2023-54210-7a73@gregkh/T"}],"tags":["nvd","csaf","vex","red-hat","cve.org","score-dispute"],"epss":0.00148,"epssPercentile":0.03981,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:39:22.862450Z"},"scores":{"nvd":7.8,"vendor":4.4,"cna":7.8},"ingestedAt":"2026-10-15T22:48:25.434Z","slug":"CVE-2023-54210","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()\n\nKASAN reports that there's a use-after-free in\nhci_remove_adv_monitor(). Trawling through the disassembly, you can\nsee that the complaint is from the access in bt_dev_dbg() under the\nHCI_ADV_MONITOR_EXT_MSFT case. The problem case happens because\nmsft_remove_monitor() can end up freeing the monitor\nstructure. Specifically:\n  hci_remove_adv_monitor() ->\n  msft_remove_monitor() ->\n  msft_remove_monitor_sync() ->\n  msft_le_cancel_monitor_advertisement_cb() ->\n  hci_free_adv_monitor()\n\nLet's fix the problem by just stashing the relevant data when it's\nstill valid.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54210.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":230101,"id":"CVE-2023-54210","ts":1793124790008,"field":"cvss","old":"4.4","new":"7.8"},{"seq":230100,"id":"CVE-2023-54210","ts":1793124790008,"field":"severity","old":"medium","new":"high"},{"seq":223787,"id":"CVE-2023-54210","ts":1792238426064,"field":"cvss","old":"7.8","new":"4.4"},{"seq":223786,"id":"CVE-2023-54210","ts":1792238426064,"field":"severity","old":"high","new":"medium"}]}