CVE-2023-54164: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54164 is a locking and validity issue in the Linux kernel's Bluetooth ISO (Isochronous) socket implementation. The vulnerability stems from race conditions where operations checking or updating sk->sk_state and accessing iso_pi(sk)->conn do not consistently hold the required socket lock (lock_sock), leading to potential use-after-free or null pointer dereference conditions. It affects the Linux kernel and was published on December 30, 2025. The CVSS score and severity rating have not been publicly assigned at this time (Feedly).

The root cause is a concurrency/race condition (CWE-362) in the Linux kernel's Bluetooth ISO subsystem. The correct lock acquisition order is hci_dev_lock > lock_sock > iso_conn_lock, but this order was not consistently enforced in iso_connect_cis/bis and sendmsg/recvmsg paths. Specifically, iso_conn_del — which frees the iso_conn structure — could execute concurrently with iso_connect_cis/bis, resulting in a use-after-free. Additionally, iso_conn_add could return an iso_conn with a NULL hcon when reusing an old CIS connection waiting for disconnect timeout, as conn->hcon is set to NULL in __iso_sock_close. The fix holds hdev->lock longer to prevent iso_conn_del from occurring during connection setup, and adds lock_sock around sk_state and conn updates in connect and send/receive paths (Feedly).

Successful exploitation of this race condition could allow a local attacker to trigger a use-after-free or null pointer dereference in the kernel's Bluetooth ISO subsystem, potentially leading to a kernel panic (denial of service) or, in more severe scenarios, privilege escalation or arbitrary code execution in kernel context. The vulnerability is confined to systems with Bluetooth hardware and the ISO socket functionality enabled. Data confidentiality and integrity could be at risk if kernel memory is corrupted or read by an unprivileged local user (Feedly).

The vulnerability is resolved in the Linux kernel via upstream patches committed to the stable kernel tree (commits 88ad50f2b843, d40ae85ee62e, and e969bfed84c1). Users should update to a patched kernel version that includes these fixes. As a workaround, disabling Bluetooth ISO socket support or restricting access to Bluetooth functionality for unprivileged users can reduce exposure. Distributions such as those tracked by Nessus (plugin 281527) and Qualys (detections 760604, 760600) should apply vendor-provided kernel updates as they become available (Feedly).