https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 22:31:40 +0000 https://vulnerability.circl.lu/vuln/cve-2023-54038 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link</p> <p>hci_connect_sco currently returns NULL when there is no link (i.e. when hci_conn_link() returns NULL).</p> <p>sco_connect() expects an ERR_PTR in case of any error (see line 266 in sco.c). Thus, hcon set as NULL passes through to sco_conn_add(), which tries to get hcon-&gt;hdev, resulting in dereferencing a NULL pointer as reported by syzkaller.</p> <p>The same issue exists for iso_connect_cis() calling hci_connect_cis().</p> <p>Thus, make hci_connect_sco() and hci_connect_cis() return ERR_PTR instead of NULL.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link</p> <p>hci_connect_sco currently returns NULL when there is no link (i.e. when hci_conn_link() returns NULL).</p> <p>sco_connect() expects an ERR_PTR in case of any error (see line 266 in sco.c). Thus, hcon set as NULL passes through to sco_conn_add(), which tries to get hcon-&gt;hdev, resulting in dereferencing a NULL pointer as reported by syzkaller.</p> <p>The same issue exists for iso_connect_cis() calling hci_connect_cis().</p> <p>Thus, make hci_connect_sco() and hci_connect_cis() return ERR_PTR instead of NULL.</p> https://vulnerability.circl.lu/vuln/cve-2023-54038