---
id: CVE-2023-54210
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()

  KASAN reports that there's a use-after-free in
  hci_remove_adv_monitor()
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()

  KASAN reports that there's a use-after-free in
  hci_remove_adv_monitor(). Trawling through…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 6
  - enterprise_linux 9
published: '2025-12-30'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:17:55.287'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-54210'
references:
  - url: 'https://git.kernel.org/stable/c/0d4d6b083da9b033ddccef72d77f373c819ae3ea'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bf00c2c8f6254f44ac041aa9a311ae9e0caf692b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/de6dfcefd107667ce2dbedf4d9337f5ed557a4a1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54210.json
  - url: 'https://access.redhat.com/security/cve/CVE-2023-54210'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2426229'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2023-54210'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-54210'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2025123024-CVE-2023-54210-7a73@gregkh/T
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00148
epssPercentile: 0.03981
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:39:22.862450Z'
scores:
  nvd: 7.8
  vendor: 4.4
  cna: 7.8
ingestedAt: '2026-10-15T22:48:25.434Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()

KASAN reports that there's a use-after-free in
hci_remove_adv_monitor(). Trawling through the disassembly, you can
see that the complaint is from the access in bt_dev_dbg() under the
HCI_ADV_MONITOR_EXT_MSFT case. The problem case happens because
msft_remove_monitor() can end up freeing the monitor
structure. Specifically:
  hci_remove_adv_monitor() ->
  msft_remove_monitor() ->
  msft_remove_monitor_sync() ->
  msft_le_cancel_monitor_advertisement_cb() ->
  hci_free_adv_monitor()

Let's fix the problem by just stashing the relevant data when it's
still valid.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54210.json)