huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-53769: kernel: virt/coco/sev-guest: Double-buffer messages
Component: kernel
Severity: Moderate
CWE: CWE-319 (Cleartext Transmission of Sensitive Information)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L)
Public date: 2025-12-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

virt/coco/sev-guest: Double-buffer messages

The encryption algorithms read and write directly to shared unencrypted
memory, which may leak information as well as permit the host to tamper
with the message integrity. Instead, copy whole messages in or out as
needed before doing any computation on them.

Statement: This vulnerability is rated as Moderate by Red Hat. The vulnerability primarily impacts confidentiality and integrity, because plaintext or intermediate values can be observed via shared unencrypted memory and as such there can be host-controlled modifications of the message buffer that can influence what is encrypted or verified and decrypted. Impact on availability is limited to tampering causing request failures or EBADMSG errors. However, triggering this vulnerability most likely requires elevated privileges that correspond to hypervisor or host-level control (typically higher than what a guest local user will possess).

Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 577a64725bfd77645986168e953d405067ee565b
CVE-2023-53780: kernel: drm/amd/display: fix FCLK pstate change underflow
Component: kernel
Severity: Moderate
CWE: CWE-191 (Integer Underflow (Wrap or Wraparound))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A calculation flaw was found in the AMD display driver in the Linux kernel. When UCLK p-state is not supported, FCLK p-state change watermarks are incorrectly calculated using dummy values, potentially causing underflow. This can lead to display issues or system instability during power state transitions.

Statement: This is a driver logic bug affecting AMD display power management calculations. Impact is limited to display glitches or driver errors rather than security-relevant memory corruption.

Affected upstream versions: 4.15
Fixed upstream versions: 0, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4bdfa48d74649898468a0bf5c8b8a48dded77b4a
CVE-2023-53781: kernel: smc: Fix use-after-free in tcp_write_timer_handler()
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-12-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smc: Fix use-after-free in tcp_write_timer_handler().

With Eric's ref tracker, syzbot finally found a repro for
use-after-free in tcp_write_timer_handler() by kernel TCP
sockets. [0]

If SMC creates a kernel socket in __smc_create(), the kernel
socket is supposed to be freed in smc_clcsock_release() by
calling sock_release() when we close() the parent SMC socket.

However, at the end of smc_clcsock_release(), the kernel
socket's sk_state might not be TCP_CLOSE.  This means that
we have not called inet_csk_destroy_sock() in __tcp_close()
and have not stopped the TCP timers.

The kernel socket's TCP timers can be fired later, so we
need to hold a refcnt for net as we do for MPTCP subflows
in mptcp_subflow_create_socket().

[0]:
leaked reference.
 sk_alloc (./include/net/net_namespace.h:335 net/core/sock.c:2108)
 inet_create (net/ipv4/af_inet.c:319 net/ipv4/af_inet.c:244)
 __sock_create (net/socket.c:1546)
 smc_create (net/smc/af_smc.c:3269 net/smc/af_smc.c:3284)
 __sock_create (net/socket.c:1546)
 __sys_socket (net/socket.c:1634 net/socket.c:1618 net/socket.c:1661)
 __x64_sys_socket (net/socket.c:1672)
 do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
 entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
==================================================================
BUG: KASAN: slab-use-after-free in tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594)
Read of size 1 at addr ffff888052b65e0d by task syzrepro/18091

CPU: 0 PID: 18091 Comm: syzrepro Tainted: G        W          6.3.0-rc4-01174-gb5d54eb5899a #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.amzn2022.0.1 04/01/2014
Call Trace:
 <IRQ>
 dump_stack_lvl (lib/dump_stack.c:107)
 print_report (mm/kasan/report.c:320 mm/kasan/report.c:430)
 kasan_report (mm/kasan/report.c:538)
 tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594)
 tcp_write_timer (./include/linux/spinlock.h:390 net/ipv4/tcp_timer.c:643)
 call_timer_fn (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/timer.h:127 kernel/time/timer.c:1701)
 __run_timers.part.0 (kernel/time/timer.c:1752 kernel/time/timer.c:2022)
 run_timer_softirq (kernel/time/timer.c:2037)
 __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:572)
 __irq_exit_rcu (kernel/softirq.c:445 kernel/softirq.c:650)
 irq_exit_rcu (kernel/softirq.c:664)
 sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1107 (discriminator 14))
 </IRQ>


Affected upstream versions: 4.11
Fixed upstream versions: 0, 6.2.12, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1cc41c8acfc1ee30b4868559058db97fa44b0137
CVE-2023-53784: kernel: drm: bridge: dw_hdmi: fix connector access for scdc
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A vulnerability was found in the Linux kernel's DRM subsystem, specifically within the DW HDMI bridge driver .A prior commit intended to improve SCDC (Source Connection Description Channel) debugging changed the interface to retrieve an I2C adapter from a connector structure. However, in the dw_hdmi implementation, the wrong connector pointer was inadvertently used to access the I2C adapter information. This incorrect usage, particularly when the Digital Visual Interface or DisplayPort connector was not properly initialized via the bridge attachment callback, resulting in a NULL pointer dereference.


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.4.5, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 552f79aa9e801ed4f74d6b3221af78042ba4f235
CVE-2023-53786: kernel: dm flakey: fix a crash with invalid table line
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A flaw was identified in the device-mapper “dm flakey” target in the Linux kernel where invalid table line input can lead to a NULL pointer dereference. Specifically, when dmsetup is used with a malformed table line (such as with the corrupt_bio_byte target) and the arg_name pointer is NULL, the kernel attempts to dereference it, leading to a system crash (kernel panic). This is due to insufficient validation of input arguments before use


Affected upstream versions: 3.1
Fixed upstream versions: 0, 4.14.315, 4.19.283, 5.10.180, 5.15.111, 5.4.243, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f95cb1526669ccdf7eb12eefd57a893953e3595f
CVE-2023-53791: kernel: md: fix warning for holder mismatch from export_rdev()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-09T00:00:00+00:00

A logic inconsistency was identified in the Linux kernel md (multiple device) driver involving the export_rdev() function and associated block device holder bookkeeping. Under certain sequences where mddev->external is toggled, the code would use one holder (claim_rdev) to get a block device but a different holder (rdev) to put it back, leading to a mismatch in reference accounting. This could result in spurious kernel warnings and potential resource lifetime misbehavior when interacting with md devices via sysfs


Affected upstream versions: 6.5
Fixed upstream versions: 0, 6.5.5, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 99fcd427178d0f58f5520f8f01df727f8eaeb2c7
CVE-2023-53793: kernel: perf tool x86: Fix perf_env memory leak
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

perf tool x86: Fix perf_env memory leak

Found by leak sanitizer:
```
==1632594==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 21 byte(s) in 1 object(s) allocated from:
    #0 0x7f2953a7077b in __interceptor_strdup ../../../../src/libsanitizer/asan/asan_interceptors.cpp:439
    #1 0x556701d6fbbf in perf_env__read_cpuid util/env.c:369
    #2 0x556701d70589 in perf_env__cpuid util/env.c:465
    #3 0x55670204bba2 in x86__is_amd_cpu arch/x86/util/env.c:14
    #4 0x5567020487a2 in arch__post_evsel_config arch/x86/util/evsel.c:83
    #5 0x556701d8f78b in evsel__config util/evsel.c:1366
    #6 0x556701ef5872 in evlist__config util/record.c:108
    #7 0x556701cd6bcd in test__PERF_RECORD tests/perf-record.c:112
    #8 0x556701cacd07 in run_test tests/builtin-test.c:236
    #9 0x556701cacfac in test_and_print tests/builtin-test.c:265
    #10 0x556701cadddb in __cmd_test tests/builtin-test.c:402
    #11 0x556701caf2aa in cmd_test tests/builtin-test.c:559
    #12 0x556701d3b557 in run_builtin tools/perf/perf.c:323
    #13 0x556701d3bac8 in handle_internal_command tools/perf/perf.c:377
    #14 0x556701d3be90 in run_argv tools/perf/perf.c:421
    #15 0x556701d3c3f8 in main tools/perf/perf.c:537
    #16 0x7f2952a46189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: 21 byte(s) leaked in 1 allocation(s).
```


Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 75d65c1cc439606ada882755fd205d13c2c7907d
CVE-2023-53795: kernel: iommufd: IOMMUFD_DESTROY should not increase the refcount
Component: kernel
Severity: Moderate
CWE: CWE-421 (Race Condition During Access to Alternate Channel)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-09T00:00:00+00:00

A race condition was identified in the iommufd subsystem of the Linux kernel where the IOMMUFD_DESTROY command incorrectly increments an object’s reference count without holding the expected exclusive synchronization (destroy_rwsem). This violates the assumption that temporary reference count elevations are always protected by the relevant lock, potentially leading to use of freed objects or other inconsistent states under concurrent access.


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.4.8, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 495b327435b0298e9b3b434f5834d459a93673ce
CVE-2023-53803: kernel: scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

An out-of-bounds read vulnerability was found in the SCSI Enclosure Services (SES) driver in the Linux kernel. The ses_enclosure_data_process() function lacks proper bounds checking when processing additional descriptor pointers, allowing reads beyond allocated slab memory when handling malformed enclosure data.

Statement: Exploitation requires a SCSI enclosure device providing malformed data, either through a malicious device or corrupted firmware responses. Standard systems without SAS/SCSI enclosures are not at risk.

Affected upstream versions: 2.6.32
Fixed upstream versions: 0, 4.14.308, 4.19.276, 5.10.173, 5.15.99, 5.4.235, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: da1a955c48a16e16e925d6544793914e52a6fa51
CVE-2023-53806: kernel: drm/amd/display: populate subvp cmd info only for the top pipe
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

An out-of-bounds array access was found in the AMD display driver in the Linux kernel. When populating SubVP command info, the driver incorrectly processes both pipes instead of just the top pipe. This causes an out-of-bounds array access leading to a page fault and system restart when changing to 8K resolution in extended display mode.

Statement: This issue affects AMD GPU systems with multi-pipe display configurations, specifically when switching to 8K resolution. The OOB access causes a system crash rather than exploitable memory corruption.

Affected upstream versions: 4.15
Fixed upstream versions: 0, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 92e6c79acad4b96efeff261d27bdbd8089a7dd24
CVE-2023-53809: kernel: Kernel: Denial of Service via recursive deadlock in L2TP tunnel registration
Component: kernel
Severity: Low
CWE: CWE-833 (Deadlock)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A flaw was found in the kernel. A local user can exploit this vulnerability by passing a pppol2tp socket file descriptor as a UDP socket file descriptor during L2TP tunnel registration. This can cause a recursive deadlock, leading to a denial of service (DoS) on the system.


Affected upstream versions: 5.10.166 < 5.10.173, 5.15.91 < 5.15.99, 6.1.9 < 6.1.16, 6.2
Fixed upstream versions: 0, 5.10.173, 5.15.99, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4a413d360959962995e16a899cf2b9ef53e9fcb9
CVE-2023-53810: kernel: blk-mq: release crypto keyslot before reporting I/O complete
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 4.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-12-09T00:00:00+00:00

A flaw was identified in the block multi-queue (blk-mq) subsystem of the Linux kernel where the crypto keyslot associated with a block I/O request could be released after upper layers have been notified that the I/O operation completed. Under certain conditions, this could lead to a use-after-free of the crypto keyslot object if a filesystem segment attempts to evict a crypto key while I/O is still effectively using it.


Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 874bdf43b4a7dc5463c31508f62b3e42eb237b08
CVE-2023-53811: kernel: RDMA/irdma: Cap MSIX used to online CPUs + 1
Component: kernel
Severity: Moderate
CWE: CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A bounds checking flaw was found in the Intel RDMA (irdma) driver in the Linux kernel. The driver may request more MSIX vectors than online CPUs allow, then attempt to set CPU affinity hints with an invalid CPU mask. This triggers kernel warnings and could cause instability.

Statement: This affects Intel Ethernet adapters with RDMA capability (E810, etc.). The bug causes kernel warnings during driver initialization when MSIX vector count exceeds online CPU count plus one.

Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.99, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 87674a359ad173a3b8cd484e92e4f1901666da4c
CVE-2023-53813: kernel: ext4: fix rbtree traversal bug in ext4_mb_use_preallocated
Component: kernel
Severity: Moderate
CWE: CWE-821 (Incorrect Synchronization)
CVSS v3: 6.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-09T00:00:00+00:00

A flaw was identified in the ext4 filesystem’s block preallocation allocator in the Linux kernel. During allocation, the code traverses an rbtree of per-inode preallocations.Concurrently, the helper ext4_mb_discard_group_preallocation() can mark PAs as deleted, which may cause a naive rbtree traversal to skip eligible entries. In certain conditions, this inconsistent traversal can result in missing a preallocation that would satisfy the allocation request and instead creating a new preallocation that overlaps an existing one. This can lead to the kernel hitting a BUG_ON() or other integrity faults, potentially causing memory corruption or a system crash.


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.4.8, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 339fee69a1daa71d6f97e47a867e2c32419a2406
CVE-2023-53816: kernel: drm/amdkfd: fix potential kgd_mem UAFs
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A flaw was found in the Linux kernel related to improper synchronization in a filesystem allocation path. Under certain conditions, concurrent operations may access and modify shared kernel data structures without adequate locking. This race condition can result in inconsistent internal state, triggering kernel warnings, memory corruption, or a system crash.


Affected upstream versions: 3.19
Fixed upstream versions: 0, 6.1.23, 6.2.10, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5045360f3bb62ccd4f87202e33489f71f8bbc3fc
CVE-2023-53819: kernel: amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-09T00:00:00+00:00

A flaw was found in the AMDGPU graphics driver within the Linux kernel was identified where the offset_in_bo parameter in the drm_amdgpu_gem_va handler was not sufficiently validated. Under certain conditions, an addition of offset_in_bo and map_size can overflow, resulting in an out-of-bounds access during GPU virtual memory range updates. A local user with the ability to interact with the affected driver could exploit this behavior to cause memory corruption,


Affected upstream versions: 4.2
Fixed upstream versions: 0, 4.19.313, 5.10.188, 5.15.121, 5.4.275, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 82aace80cfaab778245bd2f9e31b67953725e4d0
CVE-2023-53821: kernel: ip6_vti: fix slab-use-after-free in decode_session6
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-09T00:00:00+00:00

A use-after-free vulnerability was found in the IPv6 VTI (Virtual Tunnel Interface) implementation in the Linux kernel. When an IPv6 VTI device uses the SFB (Stochastic Fair Blue) qdisc, the control block (cb) field of an skb can be modified during packet enqueuing. The decode_session6() function then reads from this modified cb field, accessing freed memory (IP6CB(skb)->nhoff was not set for transmit path). This can lead to kernel crashes or potentially arbitrary code execution.

Statement: This is a use-after-free vulnerability in IPv6 VTI tunnel handling that can be triggered when specific qdisc configurations are used. The vulnerability requires local access and specific network configuration involving VTI tunnels with SFB qdisc.

Affected upstream versions: 3.19
Fixed upstream versions: 0, 4.14.324, 4.19.293, 5.10.192, 5.15.128, 5.4.255, 6.1.47, 6.4.12, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0f0ab8d52ee0062b28367dea23c29e254a26d7db
CVE-2023-53823: kernel: block/rq_qos: protect rq_qos apis with a new lock
Component: kernel
Severity: Low
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

Multiple race condition vulnerabilities were found in the block layer's request quality of service (rq_qos) subsystem in the Linux kernel. The rq_qos APIs lacked proper synchronization, leading to: concurrent writes to q->rq_qos causing data corruption, NULL pointer dereferences when rq_qos_exit() races with cgroup policy activation, and memory leaks when disk deletion races with rq_qos additions. These issues can cause system instability or crashes.

Statement: These are race condition vulnerabilities in the block layer's QoS subsystem that can be triggered when using I/O cost or latency controllers through cgroups while disks are being removed. The impact requires specific timing conditions and cgroup usage.

Affected upstream versions: 5.18.8 < 5.19, 5.19
Fixed upstream versions: 0, 5.19, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 16398b4638b5cd8c1dc95fc940a1591a801d53ce
CVE-2023-53827: kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}

Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free
caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to
prevent referencing a channel that is about to be destroyed.

Statement: A race in the L2CAP disconnect request/response handlers could access a channel that is being destroyed, causing a use-after-free and kernel crash. The fix uses l2cap_chan_hold_unless_zero() and proper locking around channel deletion to avoid referencing freed objects. An adjacent attacker over Bluetooth can trigger this during disconnect handling on an active link. Likely only denial-of-service kind of attack possible, but cannot prove this.
The complexity of attack is high, because it requires a precise race condition between the local channel teardown (triggered by the kernel) and a crafted L2CAP_DisconnectReq or L2CAP_DisconnectRsp message sent by the remote peer at exactly the same time. The timing window is very narrow — the attacker must send or respond to the disconnect while the kernel is already in the process of releasing the l2cap_chan structure but before the reference count reaches zero. Achieving this reliably would require repeated connect/disconnect cycles or fuzzing at the signaling layer, making stable exploitation unlikely outside of a controlled test setup.

Affected upstream versions: 3.5
Fixed upstream versions: 0, 4.14.313, 4.19.281, 5.10.178, 5.15.108, 5.4.241, 6.1.25, 6.2.12, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f2d38e77aa5f3effc143e7dd24da8acf02925958