CVE-2023-54038

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-54038
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-54038.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-54038
Downstream
Related
Published
2025-12-24T10:56:04.623Z
Modified
2026-03-31T17:29:50.195916074Z
Summary
Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link
Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hciconn: return ERRPTR instead of NULL when there is no link

hciconnectsco currently returns NULL when there is no link (i.e. when hciconnlink() returns NULL).

scoconnect() expects an ERRPTR in case of any error (see line 266 in sco.c). Thus, hcon set as NULL passes through to scoconnadd(), which tries to get hcon->hdev, resulting in dereferencing a NULL pointer as reported by syzkaller.

The same issue exists for isoconnectcis() calling hciconnectcis().

Thus, make hciconnectsco() and hciconnectcis() return ERR_PTR instead of NULL.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54038.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
06149746e7203d5ffe2d6faf9799ee36203aa8b8
Fixed
357ab53c83a5322437fa434e9a9e3e0bafe6b383
Fixed
b4066eb04bb67e7ff66e5aaab0db4a753f37eaad
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f72fc94a17d45be98aecfd59c39b5b24a6a342e2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-54038.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.4.0
Fixed
6.4.7

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-54038.json"