CVE-2023-53520 [Medium] | Security Vulnerability in Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix hci_suspend_sync crash If hci_unregister_dev() frees the hci_dev object but hci_suspend_notifier may still be accessing it, it can cause the program to crash. Here's the call trace: <4>[102152.653246] Call Trace: <4>[102152.653254] hci_suspend_sync+0x109/0x301 [bluetooth] <4>[102152.653259] hci_suspend_dev+0x78/0xcd [bluetooth] <4>[102152.653263] hci_suspend_notifier+0x42/0x7a [bluetooth] <4>[102152.653268] notifier_call_chain+0x43/0x6b <4>[102152.653271] __blocking_notifier_call_chain+0x48/0x69 <4>[102152.653273] __pm_notifier_call_chain+0x22/0x39 <4>[102152.653276] pm_suspend+0x287/0x57c <4>[102152.653278] state_store+0xae/0xe5 <4>[102152.653281] kernfs_fop_write+0x109/0x173 <4>[102152.653284] __vfs_write+0x16f/0x1a2 <4>[102152.653287] ? selinux_file_permission+0xca/0x16f <4>[102152.653289] ? security_file_permission+0x36/0x109 <4>[102152.653291] vfs_write+0x114/0x21d <4>[102152.653293] __x64_sys_write+0x7b/0xdb <4>[102152.653296] do_syscall_64+0x59/0x194 <4>[102152.653299] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 This patch holds the reference count of the hci_dev object while processing it in hci_suspend_notifier to avoid potential crash caused by the race condition.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2025-10-01	—	0.02%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2025-10-01

—

0.02%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
4.7	3.1	MEDIUM	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.0	3.6	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

4.7

3.1

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.0

3.6

[email protected]

OS Trackers for CVE-2023-53520

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2023-53520 not yet assigned priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 4, open 1.	https://security-tracker.debian.org/tracker/CVE-2023-53520
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2023-53520
`suse`	high	CVE-2023-53520 severity important: SUSE including 402 source package names (2.1.3-6.80:kernel-default-base-6.4.0-35.1.21.12, 2.1.3-7.57:kernel-default-6.4.0-35.1, …), 868 product×package rows across 182 product lines (Container suse/sl-micro/6.0/base-os-container, Container suse/sl-micro/6.0/kvm-os-container, … (182 product lines)): Fixed 442, Known Affected 231, Known Not Affected 195.	https://www.suse.com/security/cve/CVE-2023-53520/
`ubuntu`	medium	CVE-2023-53520 medium priority: Ubuntu including 158 source packages (linux, linux-allwinner-5.19, …), 1414 status rows across 9 suites (bionic, focal, jammy, noble, plucky, questing, trusty, upstream, xenial): DNE 1017, ignored 162, released 107, not-affected 70, needed 45, pending 11, needs-triage 2.	https://ubuntu.com/security/CVE-2023-53520

Affected software / configurations for CVE-2023-53520

Vendor	Product	Version	Raw CPE
linux	linux_kernel	>= 5.7, < 6.1.55	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.2, < 6.5.5	cpe:2.3:o:linux:linux_kernel::::::::

References for CVE-2023-53520

URL	Tags
https://git.kernel.org/stable/c/06e2b5ad72b60f90bfe565c201346532e271f484	Patch
https://git.kernel.org/stable/c/573ebae162111063eedc6c838a659ba628f66a0f	Patch
https://git.kernel.org/stable/c/e1fa25a91091bbed691ba2996a6cee809e3309a2	Patch
https://git.kernel.org/stable/c/f9c8ce5d665653e3cf71a76349d41d7a7f7947e6	Patch

URL

CVE-2023-53520 | Bluetooth: Fix hci_suspend_sync crash

Exploit prediction scoring system (EPSS) score for CVE-2023-53520

Common vulnerability scoring system (CVSS) metrics for CVE-2023-53520

Weakness enumeration for CVE-2023-53520

OS Trackers for CVE-2023-53520

Affected software / configurations for CVE-2023-53520

References for CVE-2023-53520