CVE-2023-53297

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp

conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance' is triggered.

This vulnerability is rated as Moderate severity because triggering the improper lock release requires established Bluetooth L2CAP communications, restricting exploitation to local or adjacent environments with active Bluetooth controllers. Standard Red Hat Enterprise Linux server installations rarely enable or utilize Bluetooth hardware by default, significantly limiting the exposed attack surface. The resulting condition leads to a kernel lock imbalance, which can cause denial of service through kernel crashes or unpredictable system behavior.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.