Executive brief
The Linux kernel's Bluetooth subsystem contains a race condition in the hci_suspend_notifier function that can lead to a system crash when a Bluetooth device is unregistered while a suspend/resume operation is in progress. An attacker with local access could trigger this crash by unregistering a Bluetooth device at a specific moment during system suspend, resulting in denial of service to the affected system.
Technical details
This is a use-after-free vulnerability in the Bluetooth HCI (Host Controller Interface) layer of the Linux kernel. The hci_suspend_notifier function may attempt to access an hci_dev object that has been freed by a concurrent call to hci_unregister_dev(). The vulnerability exists because the reference count on the hci_dev object is not held while the notifier processes it, creating a race condition between device unregistration and suspend notification handling. The fix adds hci_dev_hold() at the start of hci_suspend_notifier and hci_dev_put() at the end to protect the object from being freed during use. The vulnerability requires local system access and occurs specifically during system suspend operations.
Affected products
- Linux Linux kernel Multiple versions prior to fix (patched in upstream commit 573ebae16 / 06e2b5ad72)
Timeline
- 2023-08-11: disclosed: Upstream commit 573ebae162 merged
- 2023-09-23: patched: Stable kernel backport commit 06e2b5ad72
- 2025-10-01: advisory: CVE-2023-53520 published