Security readout for executives and security teams
Plain-English summary
CVE-2023-53673 is a Linux kernel Bluetooth bug that can leave parts of the Bluetooth stack using a connection object after it has been deleted. The documented impact is kernel crash behavior, including NULL pointer dereference and use-after-free evidence. Public sources do not show active exploitation or a CVSS score.
Executive priority
Prioritize routine-to-expedited patching for Linux endpoints and embedded systems using Bluetooth. Escalate if Bluetooth is required in exposed, safety-sensitive, or hard-to-reboot environments. There is not enough public evidence to justify emergency response solely from this bundle.
Technical view
In hci_cs_disconnect, the kernel could call hci_conn_del after a failed disconnect before ISO, L2CAP, and SCO cleanup callbacks ran. Those layers referenced hci_conn without hci_conn_get, creating use-after-free conditions in Bluetooth send paths. The fix changes disconnect cleanup ordering.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel builds with Bluetooth enabled or reachable through Bluetooth stack paths. The source lists Linux kernel versions around 5.7 through later stable series, with fixes referenced in kernel stable commits. Distro backports must be checked separately.
Exploitation context
The bundle provides crash traces and KASAN evidence, but no exploit code, no KEV listing, and no cited active exploitation. Treat this as a kernel stability and potential local-adjacent Bluetooth risk until vendor-specific advisories clarify exploitability.
Researcher notes
Key uncertainty is exploitability beyond denial of service. The evidence shows object lifetime misuse across ISO, L2CAP, and SCO cleanup paths after failed disconnect status. Validate against exact downstream kernel patches because distro kernels may carry fixes without matching upstream version labels.
Mitigation direction
- Apply vendor kernel updates containing the referenced stable Bluetooth fixes.
- Check distribution advisories for backported fixes before relying on upstream version numbers.
- Disable Bluetooth on systems that do not require it until patched.
- Prioritize laptops, embedded Linux, kiosks, and servers with active Bluetooth adapters.
Validation and detection
- Inventory Linux kernel versions and Bluetooth enablement across managed assets.
- Map installed kernels to vendor advisories or the referenced stable commits.
- Review kernel logs for Bluetooth Oops, KASAN, or use-after-free indicators.
- Confirm patched systems boot the updated kernel, not only install the package.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-53673 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1ecf6dc2676ead4b927c50b1be0851fa4d756574CVE reference, Linux
- https://git.kernel.org/stable/c/59bd1e476bbc7bc6dff3c61bba787095a4839796CVE reference, Linux
- https://git.kernel.org/stable/c/093a07052406b363b1b2ab489e17dbadaf3e509bCVE reference, Linux
- https://git.kernel.org/stable/c/7f7cfcb6f0825652973b780f248603e23f16ee90CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.