CVE-2023-54197

Vulnerability

CVE-2023-54197 documents a revert of commit 1e9ac114c4428f77db7ff4635b45d4f46017e8916f in the Linux kernel's Bluetooth btsdio driver. The original commit was intended to fix a use-after a use-after-free bug in btsdio_remove caused by unfinished work, but it inadvertently introduced a possible null-pointer dereference (null-ptr-def) problem [1].

Exploitation

Exploitation

No specific exploitation scenario is described beyond the kernel code context. The vulnerability is a logic error path in driver removal; an attacker would need the ability to trigger the removal of a btsdio device (e.g., via hot-unplug or system shutdown) while work is still pending, leading to a null-pointer dereference in the kernel.

Impact

A successful trigger of the null-pointer dereference could cause a kernel crash (denial of service). The original use-after-free bug that the reverted patch attempted to fix has already been resolved by a separate commit 73f7b171b7c0 ("Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition") [1].

Mitigation

The fix is to revert the problematic commit. The stable kernel branches have applied this revert (commit db2bf510bd5d57f064d9e1db395ed86a08320c54) [1]. Users should update to a kernel version containing this revert to avoid the null-pointer dereference.