Executive brief
A vulnerability in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) implementation allows a potential use-after-free condition when sending data. If a Bluetooth connection is unexpectedly closed while the kernel is allocating memory for data transmission, the system may attempt to operate on freed memory, potentially causing a kernel crash or allowing code execution. This affects systems with Bluetooth connectivity.
Technical details
The vulnerability is a use-after-free in the L2CAP channel send path (l2cap_chan_send function in net/bluetooth/l2cap_core.c). The root cause is a race condition where the channel lock is released during alloc_skb() memory allocation and reacquired afterward, but the channel may be disconnected in the interim. After reacquisition, the code did not validate that the channel was still in the BT_CONNECTED state before proceeding, leading to potential operations on freed channel structures. An attacker with local Bluetooth access can trigger a channel disconnection to exploit this race condition. The fix consolidates state validation into the alloc_skb callback (l2cap_sock_alloc_skb_cb) to ensure the channel is still connected before returning the allocated buffer. No user interaction is required; the vulnerability is triggered through normal Bluetooth protocol handling.
Affected products
- Linux Linux Kernel multiple versions before fix (patched in various stable branches)
Timeline
- 2023-02-01: disclosed: Fix authored by Luiz Augusto von Dentz
- 2023-03-10: patched: Patch merged to stable kernel branches (commit 31a288a4df7f6a28e65da22a4ab2add4a963738e)
- 2025-12-30: advisory: CVE-2023-54214 published