CVE-2023-54038: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54038 is a NULL pointer dereference vulnerability in the Linux kernel's Bluetooth HCI connection handling subsystem. The flaw exists in the hci_connect_sco() and hci_connect_cis() functions, which incorrectly return NULL instead of ERR_PTR when no link is available, causing a kernel NULL pointer dereference when the caller attempts to access hcon->hdev. The vulnerability was reported by syzkaller and publicly disclosed on December 24, 2025. It affects Linux kernel versions in the 6.4 series (prior to 6.4.7) and was fixed in 6.5. Red Hat rates this as Medium severity with a CVSS v3.1 base score of 7.0 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper error handling (CWE-476, NULL Pointer Dereference) in the Linux kernel's Bluetooth stack. Specifically, hci_connect_sco() returns NULL when hci_conn_link() fails to establish a link; however, sco_connect() expects an ERR_PTR-encoded error value on failure. The NULL value propagates unchecked into sco_conn_add(), which then attempts to dereference hcon->hdev, triggering a kernel panic. The same logic flaw exists in hci_connect_cis() called by iso_connect_cis(). The fix modifies both functions to return ERR_PTR(-ENOLINK) (or equivalent) instead of NULL, aligning with the caller's error-checking expectations. Exploitation requires local access with low privileges and involves triggering a Bluetooth SCO or CIS connection attempt under conditions where hci_conn_link() returns NULL (Red Hat Bugzilla, kernel.org patch 1, kernel.org patch 2).

Successful exploitation can cause a kernel panic or system crash (denial of service) by triggering a NULL pointer dereference in the Bluetooth subsystem. Because the vulnerability resides in kernel space, it may also be leveraged for local privilege escalation, with potential high impacts on confidentiality, integrity, and availability of the affected system. The attack is limited to local access and does not directly expose network-facing attack surfaces, but a crash could disrupt all services running on the affected host (Red Hat Advisory, Red Hat Bugzilla).

The fix is available in Linux kernel version 6.4.7 and 6.5+, via upstream commits 357ab53c83a5322437fa434e9a9e3e0bafe6b383 and b4066eb04bb67e7ff66e5aaab0db4a753f37eaad. Users should update to a patched kernel version as the primary remediation. As a temporary workaround, disabling Bluetooth on systems where it is not required eliminates the attack surface. Restricting local user access to the system also reduces risk, since exploitation requires low-privilege local access (kernel.org patch 1, kernel.org patch 2, Red Hat Bugzilla).