{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-7356", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-10-21T14:57:20.443Z", "datePublished": "2026-10-21T14:59:38.724Z", "dateUpdated": "2026-10-26T06:55:41.493Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-26T06:55:41.493Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID\n\nCopy the content of a Periodic Advertisement Report to BASE only if\nthe service UUID is Basic Audio Announcement Service UUID."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - A BLE Periodic Advertising Report supplies ev3->length and ev3->data through hci_recv_frame()\u2192hci_event_packet()\u2192hci_le_per_adv_report_evt()\u2192hci_proto_connect_ind()\u2192iso_connect_ind(); exploitation therefore requires Bluetooth radio proximity.\nAC:L - A single matched report with length 251\u2013255 overwrites padding and up to five low bytes of iso_pinfo.conn; iso_connect_ind() performs the memcpy deterministically, with no race or condition outside the broadcaster's control.\nPR:N - hci_le_per_adv_report_evt() performs no pairing, authentication, or authorization check before calling iso_connect_ind(); iso_match_sync_handle_pa_report() only matches the unauthenticated report to an existing periodic-advertising sync.\nUI:N - Once an ISO broadcast-sink listener is synchronized, receipt of the crafted periodic report invokes iso_connect_ind() automatically; no victim action is required for the overflowing report.\nS:U - The overwrite corrupts iso_pinfo and its iso_conn pointer within the same host kernel security authority; it does not cross a VM, IOMMU, or other security boundary.\nC:H - base[248] immediately precedes the live conn pointer, and the overflow can redirect later conn->hcon reads in iso_sock_get_qos() and related paths, providing exploitable kernel-pointer corruption capable of arbitrary memory disclosure.\nI:H - The unchecked memcpy() writes beyond iso_pinfo.base into low bytes of iso_pinfo.conn; subsequent writes and lock operations through that corrupted pointer in iso_chan_del() and timer helpers can enable arbitrary kernel-memory corruption or control-flow hijacking.\nA:H - A corrupted iso_pinfo.conn is dereferenced by iso_sock_clear_timer(), iso_sock_get_qos(), send, and close paths, allowing an unauthenticated broadcaster to trigger a kernel oops or panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/iso.c"], "versions": [{"version": "e4cfffb5ebc80820f46cf16a6fa5be1b436bdf2d", "lessThan": "ba25efe15e8fd909884e113a86c6ccd07d88256e", "status": "affected", "versionType": "git"}, {"version": "9c0826310bfb784c9bac7d1d9454e304185446c5", "lessThan": "927ef409f713929dea2b9a5ed5bb65e712be0050", "status": "affected", "versionType": "git"}, {"version": "9c0826310bfb784c9bac7d1d9454e304185446c5", "lessThan": "f4da3ee15de9944482382181329bb6d7335ca003", "status": "affected", "versionType": "git"}, {"version": "6.1.159", "lessThan": "6.1.178", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/iso.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.159", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.7"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ba25efe15e8fd909884e113a86c6ccd07d88256e"}, {"url": "https://git.kernel.org/stable/c/927ef409f713929dea2b9a5ed5bb65e712be0050"}, {"url": "https://git.kernel.org/stable/c/f4da3ee15de9944482382181329bb6d7335ca003"}], "title": "Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/iso.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ba25efe15e8fd909884e113a86c6ccd07d88256e", "status": "affected", "version": "e4cfffb5ebc80820f46cf16a6fa5be1b436bdf2d", "versionType": "git"}, {"lessThan": "927ef409f713929dea2b9a5ed5bb65e712be0050", "status": "affected", "version": "9c0826310bfb784c9bac7d1d9454e304185446c5", "versionType": "git"}, {"lessThan": "f4da3ee15de9944482382181329bb6d7335ca003", "status": "affected", "version": "9c0826310bfb784c9bac7d1d9454e304185446c5", "versionType": "git"}, {"lessThan": "6.1.178", "status": "affected", "version": "6.1.159", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/iso.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.7", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID\n\nCopy the content of a Periodic Advertisement Report to BASE only if\nthe service UUID is Basic Audio Announcement Service UUID."}], "id": "CVE-2023-7356", "lastModified": "2026-10-26T07:17:05.437", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-21T15:17:12.440", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/927ef409f713929dea2b9a5ed5bb65e712be0050"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba25efe15e8fd909884e113a86c6ccd07d88256e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f4da3ee15de9944482382181329bb6d7335ca003"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID", "id": "2558312", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558312"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-120", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID\nCopy the content of a Periodic Advertisement Report to BASE only if\nthe service UUID is Basic Audio Announcement Service UUID.", "A flaw was found in the Linux kernel's Bluetooth subsystem. An adjacent attacker within Bluetooth range could exploit this flaw by broadcasting specially crafted Bluetooth Low Energy (LE) periodic advertisement packets. Because incoming advertisement data was copied into internal socket buffers without properly validating data length and service types, an attacker could trigger a buffer overflow. This vulnerability can lead to a system crash, resulting in a denial of service (DoS), or potentially allow arbitrary code execution."], "name": "CVE-2023-7356", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-7356\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-7356\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2023/CVE-2023-7356.mbox"], "threat_severity": "Important"}