Medium · 5.5 CVE-2023-23002 EUVD-2023-27102GHSA-766m-w6rv-79q4

In the Linux kernel before 5.16.3, drivers/bluetooth/hci_qca.c misinterprets the devm_gpiod_get_index_optional return value (expects it to …

Published Mar 1, 2023 · Updated Mar 20, 2025 · Assigned by mitre

Package: kernel Package: linux Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-edge Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gke-4.15 Package: linux-gke-5.4 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.8 Package: linux-hwe-edge Package: linux-intel-5.13 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.6 Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-raspi2 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.8 Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel before 5.16.3, drivers/bluetooth/hci_qca.c misinterprets the devm_gpiod_get_index_optional return value (expects it to be NULL in the error case, whereas it is actually an error pointer).

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	linux	5.16.7-1	—
Debian 13	linux	5.16.7-1	—
Debian 12	linux	5.16.7-1	—

Ubuntu