What’s Vulnerable › Vulnerabilities

CVE-2023-7356: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-26

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID Copy the content of a Periodic Advertisement Report to BASE only if the service UUID is Basic Audio Announcement Service UUID.

Affected products

• Linux kernel: before 6.1.178; before 6.6.145 — fixed in 6.1.178, 6.6.145, 6.7

How to fix

Upgrade to a fixed version: Linux kernel 6.1.178, 6.6.145, 6.7. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/927ef409f713929dea2b9a5ed5bb65e712be0050
• https://git.kernel.org/stable/c/ba25efe15e8fd909884e113a86c6ccd07d88256e
• https://git.kernel.org/stable/c/f4da3ee15de9944482382181329bb6d7335ca003

Get alerted when CVE-2023-7356 or the next vulnerability affects your stack