cbcvebase.
CVE-2024-26801
published 2024-04-04

CVE-2024-26801: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Avoid potential use-after-free in hci_error_reset While handling the…

PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.28%
20.3th percentile
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Avoid potential use-after-free in hci_error_reset While handling the HCI_EV_HARDWARE_ERROR event, if the underlying BT controller is not responding, the GPIO reset mechanism would free the hci_dev and lead to a use-after-free in hci_error_reset. Here's the call trace observed on a ChromeOS device with Intel AX201: queue_work_on+0x3e/0x6c __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth ] ? init_wait_entry+0x31/0x31 __hci_cmd_sync+0x16/0x20 [bluetooth ] hci_error_reset+0x4f/0xa4 [bluetooth ] process_one_work+0x1d8/0x33f worker_thread+0x21b/0x373 kthread+0x13a/0x152 ? pr_cont_work+0x54/0x54 ? kthread_blkcg+0x31/0x31 ret_from_fork+0x1f/0x30 This patch holds the reference count on the hci_dev while processing a HCI_EV_HARDWARE_ERROR event to avoid potential crash.

Affected

31 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.82-1 (bookworm)linux 6.1.82-1 (bookworm)
linuxlinux
linuxlinux>= c7741d16a57cbf97eebe53f27e8216b1ff20e20c < e0b278650f07acf2e0932149183458468a731c03e0b278650f07acf2e0932149183458468a731c03
linuxlinux>= c7741d16a57cbf97eebe53f27e8216b1ff20e20c < 98fb98fd37e42fd4ce13ff657ea64503e24b609098fb98fd37e42fd4ce13ff657ea64503e24b6090
linuxlinux>= c7741d16a57cbf97eebe53f27e8216b1ff20e20c < 6dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e26dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e2
linuxlinux>= c7741d16a57cbf97eebe53f27e8216b1ff20e20c < da4569d450b193e39e87119fd316c0291b585d14da4569d450b193e39e87119fd316c0291b585d14
linuxlinux>= c7741d16a57cbf97eebe53f27e8216b1ff20e20c < 45085686b9559bfbe3a4f41d3d695a520668f5e145085686b9559bfbe3a4f41d3d695a520668f5e1
linuxlinux>= c7741d16a57cbf97eebe53f27e8216b1ff20e20c < 2ab9a19d896f5a0dd386e1f001c5309bc35f433b2ab9a19d896f5a0dd386e1f001c5309bc35f433b
linuxlinux>= c7741d16a57cbf97eebe53f27e8216b1ff20e20c < dd594cdc24f2e48dab441732e6dfcafd6b0711d1dd594cdc24f2e48dab441732e6dfcafd6b0711d1
linuxlinux>= c7741d16a57cbf97eebe53f27e8216b1ff20e20c < 2449007d3f73b2842c9734f45f0aadb522daf5922449007d3f73b2842c9734f45f0aadb522daf592
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.216-15.10.216-1
linuxlinux_kernel>= 0 < 6.1.82-16.1.82-1
linuxlinux_kernel>= 0 < 6.7.9-16.7.9-1
linuxlinux_kernel>= 0 < 6.7.9-16.7.9-1
linuxlinux_kernel>= 0 < 5.4.0-186.2065.4.0-186.206
linuxlinux_kernel>= 0 < 5.15.0-112.1225.15.0-112.122
linuxlinux_kernel>= 0 < 4.4.0-254.2884.4.0-254.288
linuxlinux_kernel>= 0 < 4.15.0-225.2374.15.0-225.237
linuxlinux_kernel>= 4.0 < 4.19.3094.19.309

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.