CVE-2023-53762

A flaw was found in the Linux kernel's Bluetooth subsystem. A use-after-free (UAF) vulnerability exists in the hci_disconnect_all_sync function. This can occur if a Bluetooth connection is deleted while a controller event is being processed concurrently. A local attacker could potentially exploit this flaw to trigger a system crash, leading to a Denial of Service.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because successful exploitation requires local access and precise timing to trigger a race condition during concurrent connection teardown. In typical enterprise environments, Bluetooth hardware is absent or disabled by default, significantly reducing exposure. Systems without active Bluetooth controllers are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.