CVE-2023-53374

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: fail SCO/ISO via hci_conn_failed if ACL gone early

Not calling hci_(dis)connect_cfm before deleting conn referred to by a socket generally results to use-after-free.

When cleaning up SCO connections when the parent ACL is deleted too early, use hci_conn_failed to do the connection cleanup properly.

We also need to clean up ISO connections in a similar situation when connecting has started but LE Create CIS is not yet sent, so do it too here.

A race in Bluetooth connection teardown allowed SCO/ISO child links to be deleted without proper hci_(dis)connect_cfm, causing a use-after-free when the parent ACL was dropped early. The fix routes such cases through hci_conn_failed() (via the new hci_conn_cleanup_child()), ensuring orderly cleanup and socket notification. Practical impact is an adjacent-network kernel DoS under tight timing. Triggering this condition is difficult in practice due to the race timing, and it would typically require an authorized user (with knowledge of the Bluetooth pairing key) to attempt it remotely.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.