CVE-2023-53016

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix possible deadlock in rfcomm_sk_state_change

syzbot reports a possible deadlock in rfcomm_sk_state_change [1]. While rfcomm_sock_connect acquires the sk lock and waits for the rfcomm lock, rfcomm_sock_release could have the rfcomm lock and hit a deadlock for acquiring the sk lock. Here's a simplified flow:

rfcomm_sock_connect: lock_sock(sk) rfcomm_dlc_open: rfcomm_lock()

rfcomm_sock_release: rfcomm_sock_shutdown: rfcomm_lock() __rfcomm_dlc_close: rfcomm_k_state_change: lock_sock(sk)

This patch drops the sk lock before calling rfcomm_dlc_open to avoid the possible deadlock and holds sk's reference count to prevent use-after-free after rfcomm_dlc_open completes.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416CWE-667

Affected software

VendorProductVersions
LinuxLinux>= 1804fdf6e494e5e2938c65d8391690b59bcff897, < 98aec50ff7f60cc6f2d6a4396b475c547e58b04d; >= 1804fdf6e494e5e2938c65d8391690b59bcff897, < 17511bd84871f4a6106cb335616e086880313f3f; >= 1804fdf6e494e5e2938c65d8391690b59bcff897, < 1d80d57ffcb55488f0ec0b77928d4f82d16b6a90
LinuxLinux5.15

References

Timeline

Published
Mar 27, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-530175.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix memory leak in hci_update_adv_data() When hciCVE-2023-530185.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix memory leaks When hci_cmd_sync_queue() failedCVE-2023-530197.8In the Linux kernel, the following vulnerability has been resolved: net: mdio: validate parameter addr in mdiobus_get_phy() The caller mayCVE-2023-53025.4A vulnerability, which was classified as problematic, has been found in SourceCodester Best Courier Management System 1.0. This issue affectCVE-2023-530204.7In the Linux kernel, the following vulnerability has been resolved: l2tp: close all race conditions in l2tp_tunnel_register() The code in CVE-2023-530217.8In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: fix possible use-after-free syzbot reported a nCVE-2023-530225.5In the Linux kernel, the following vulnerability has been resolved: net: enetc: avoid deadlock in enetc_tx_onestep_tstamp() This lockdep sCVE-2023-530237.8In the Linux kernel, the following vulnerability has been resolved: net: nfc: Fix use-after-free in local_cleanup() Fix a use-after-free tCVE-2023-530247.1In the Linux kernel, the following vulnerability has been resolved: bpf: Fix pointer-leak due to insufficient speculative store bypass mitiCVE-2023-530265.5In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix ib block iterator counter overflow When registering a nCVE-2023-530285.5In the Linux kernel, the following vulnerability has been resolved: Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()" This reCVE-2023-530295.5In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt The co
CVE-2023-53016: Medium severity, CVSS 5.5 | Vulnix