Kernel: use after free bug in btsdio_remove due to race condition

Description

A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem which leads to a UAF on hdev devices.

Timeline

Scores

EPSS (exploitation in 30 days)

0.44% · top 62% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.

Weakness

• CWE-416: Use After Free (opens in a new tab)All about CWE-416 and its CVEs

Affected products

• linux

  • affected 2.6.24 – < 4.14.326
  • affected 4.15 – < 4.19.295
  • affected 4.20 – < 5.4.257
  • affected 5.5 – < 5.10.195
  • affected 5.11 – < 5.15.131
  • affected 5.16 – < 6.1.52
  • affected 6.2 – < 6.3

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:4.18.0-513.5.1.rt7.307.el8_9 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:4.18.0-513.5.1.el8_9 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support

  • unaffected 0:4.18.0-372.91.1.el8_6 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Extended Update Support

  • unaffected 0:4.18.0-477.64.1.el8_8 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:5.14.0-362.8.1.el9_3 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:5.14.0-362.8.1.el9_3 – < *

• Red Hat · Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

  • unaffected 0:4.18.0-372.91.1.el8_6 – < *

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unknown

• Red Hat · Red Hat Enterprise Linux 7

  All versions: unknown

• Red Hat · Red Hat Enterprise Linux 7

  All versions: unknown

• Red Hat · Red Hat Enterprise Linux 9

  All versions: affected

What to do

Workaround: This flaw can be mitigated by preventing the affected Generic Bluetooth SDIO driver kernel module from loading during the boot time. Ensure the module is added into the blacklist file. ~~~ Refer: How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~

References (13)

• RHSA-2023:6583 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2023:6901 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2023:7077 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2024:0724 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2024:4740 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/security/cve/CVE-2023-1989 (opens in a new tab)vdb-entryx_refsource_REDHAT
• RHBZ#2185945 (opens in a new tab)issue-trackingx_refsource_REDHAT
• https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=f132c2d13088 (opens in a new tab)x_transferred
• [debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security update (opens in a new tab)mailing-listx_transferred
• [debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update (opens in a new tab)mailing-listx_transferred
• https://security.netapp.com/advisory/ntap-20230601-0004/ (opens in a new tab)x_transferred
• DSA-5492 (opens in a new tab)vendor-advisoryx_transferred
• [debian-lts-announce] 20240111 [SECURITY] [DLA 3710-1] linux security update (opens in a new tab)mailing-listx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-1989](https://trackcve.app/badge/CVE-2023-1989.svg)](https://trackcve.app/cve/CVE-2023-1989)

Record last updated 1 Oct 2026, 10:58 UTC.