CVE-2023-53374: 
Linux Kernel vulnerability analysis and mitigation

A use-after-free vulnerability has been identified in the Linux kernel's Bluetooth subsystem (CVE-2023-53374). The issue occurs when cleaning up SCO connections when the parent ACL is deleted too early, and when not calling hci(dis)connectcfm before deleting connections referred to by a socket. This vulnerability was published on September 18, 2025 (NVD).

The vulnerability specifically affects the Bluetooth HCI connection handling in the Linux kernel. The issue arises in two scenarios: first, when cleaning up SCO connections with an early-deleted parent ACL, and second, in ISO connections when connecting has started but LE Create CIS is not yet sent. The proper fix involves using hciconnfailed to perform connection cleanup correctly (NVD).

When exploited, this vulnerability can lead to use-after-free conditions in the Linux kernel's Bluetooth subsystem, potentially affecting system stability and security. The issue impacts various Linux distributions and kernel versions that handle Bluetooth connections (NVD).

The vulnerability has been resolved in the Linux kernel through patches that implement proper connection cleanup procedures using hciconnfailed. Multiple Linux distributions have incorporated these fixes into their security updates (NVD).