Live › vulnerability › CVE-2023-7356
Go to dashboardThe Linux kernel's Bluetooth ISO code copied Periodic Advertisement Report content into the BASE buffer without first checking the service UUID, and the fix limits the copy to Basic Audio Announcement Service data. The sources do not describe a concrete attacker outcome.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Machines running a Linux kernel with Bluetooth ISO support, typically desktops, laptops or embedded devices that use LE Audio. Servers and systems without Bluetooth hardware or with the Bluetooth module disabled are unlikely to be exposed. The sources do not state the exact affected version range.
No product ranges from the sources yet.
uname -r and compare against the kernel version that carries the upstream fix for CVE-2023-7356lsmod | grep bluetoothEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID
Copy the content of a Periodic Advertisement Report to BASE only if the service UUID is Basic Audio Announcement Service UUID.
This page as .md · .json · in your agent: get_signal("CVE-2023-7356")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.