CVE-2023-7356: Linux Kernel Bluetooth ISO BASE Vulnerability

CVE-2023-7356 Overview

CVE-2023-7356 is a vulnerability in the Linux kernel Bluetooth Isochronous Channels (ISO) subsystem. The flaw involves improper validation of service UUIDs when processing Periodic Advertisement Reports. The kernel copied report content into the Broadcast Audio Source Endpoint (BASE) structure without first confirming that the service data matched the EIR_BAA_SERVICE_UUID (Basic Audio Announcement Service UUID). Upstream maintainers resolved the issue by restricting the copy operation to reports carrying the correct service UUID.

Critical Impact
Unvalidated handling of Bluetooth Periodic Advertisement Reports could allow adjacent attackers to influence kernel data structures by broadcasting crafted advertisement data.

Affected Products

Linux kernel Bluetooth subsystem (ISO / Broadcast Audio handling)
Distributions shipping kernel versions prior to the patched commits
Systems using Bluetooth LE Audio Broadcast Isochronous Streams

Discovery Timeline

2026-10-21 - CVE-2023-7356 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2023-7356

Vulnerability Analysis

The vulnerability resides in the Bluetooth ISO code path that processes Periodic Advertisement Reports. The affected logic copied advertisement content into the BASE structure without validating that the service data corresponded to the Basic Audio Announcement Service UUID. This permitted non-matching service data to be treated as BASE content, violating the LE Audio specification's parsing expectations.

The patched behavior copies the Periodic Advertisement Report payload into BASE only when the service UUID equals EIR_BAA_SERVICE_UUID. By gating the copy on the UUID check, the kernel ensures that only semantically correct broadcast audio announcements populate the BASE buffer. Reports with mismatched or arbitrary service UUIDs are no longer processed as valid Broadcast Audio Source Endpoint data.

An adjacent attacker in Bluetooth range could broadcast crafted Periodic Advertisement packets. Without the UUID gate, those packets reach the BASE copy path and influence structures consumed by subsequent Bluetooth LE Audio logic. The CWE classification was not assigned, but the pattern aligns with improper input validation in a kernel protocol parser.

Root Cause

The root cause is a missing predicate check in the ISO Periodic Advertisement Report handler. The code performed the BASE copy unconditionally rather than verifying the EIR service UUID first. The patches at commits 927ef409f713, ba25efe15e8f, and f4da3ee15de9 add the UUID validation.

Attack Vector

Exploitation requires Bluetooth proximity and an active LE Audio broadcast scan on the target. The attacker transmits Periodic Advertisement Reports with crafted service data. No authentication or user interaction with the attacker's device is required. Impact depends on how downstream code consumes BASE contents sourced from the malformed report.

No verified public proof of concept is available. See the kernel commit details for the exact code change.

Detection Methods for CVE-2023-7356

Indicators of Compromise

Unexpected Bluetooth LE Audio broadcast scan activity in dmesg or kernel audit logs
Anomalous or malformed Periodic Advertisement Reports captured in Bluetooth HCI traces
Kernel warnings or crashes originating in the net/bluetooth/iso.c code path

Detection Strategies

Inventory kernel versions across Linux endpoints and compare against the fixed commits referenced in the stable tree
Review HCI snoop logs on systems with Bluetooth LE Audio enabled for Periodic Advertisement Reports containing non-standard service UUIDs
Correlate Bluetooth subsystem errors with proximity-based events using endpoint telemetry

Monitoring Recommendations

Enable kernel audit logging for the Bluetooth subsystem on systems that act as LE Audio Broadcast Sinks
Track installation of distribution kernel updates to confirm the patched commits are deployed
Monitor for unexpected enabling of Bluetooth scanning on servers or kiosk-class systems that should not use LE Audio

How to Mitigate CVE-2023-7356

Immediate Actions Required

Apply the latest stable kernel update from your distribution that includes commits 927ef409f713, ba25efe15e8f, or f4da3ee15de9
Disable Bluetooth on systems that do not require it, particularly servers and infrastructure hosts
Restrict physical and radio proximity access to high-value systems where Bluetooth cannot be disabled

Patch Information

The fix was committed to the Linux kernel stable tree. Review the patches at kernel commit 927ef409, kernel commit ba25efe1, and kernel commit f4da3ee1. Rebuild or reinstall the kernel after applying vendor-supplied updates and reboot.

Workarounds

Unload the Bluetooth kernel modules (bluetooth, bluetooth_6lowpan) where feasible
Disable LE Audio broadcast scanning in BlueZ configuration until the kernel is patched
Reduce Bluetooth adapter power or disable adapters in BIOS/UEFI on systems that do not require wireless connectivity

bash

# Configuration example
# Verify the running kernel version
uname -r

# Temporarily disable the Bluetooth stack
sudo systemctl stop bluetooth
sudo systemctl disable bluetooth

# Unload Bluetooth kernel modules
sudo modprobe -r bluetooth

# Blacklist loading at boot until the kernel is patched
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf