CVE-2024-26801: Bluetooth: Avoid potential use-after-free in hci_error_reset
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Avoid potential use-after-free in hcierrorreset
The Linux kernel CVE team has assigned CVE-2024-26801 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040403-CVE-2024-26801-da9f@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Avoid potential use-after-free in hcierrorreset
While handling the HCIEVHARDWAREERROR event, if the underlying BT controller is not responding, the GPIO reset mechanism would free the hcidev and lead to a use-after-free in hcierrorreset.
Here's the call trace observed on a ChromeOS device with Intel AX201: queueworkon+0x3e/0x6c hcicmdsyncsk+0x2ee/0x4c0 [bluetooth ] ? initwaitentry+0x31/0x31 hcicmdsync+0x16/0x20 [bluetooth ] hcierrorreset+0x4f/0xa4 [bluetooth ] processonework+0x1d8/0x33f workerthread+0x21b/0x373 kthread+0x13a/0x152 ? prcontwork+0x54/0x54 ? kthreadblkcg+0x31/0x31 retfromfork+0x1f/0x30
This patch holds the reference count on the hcidev while processing a HCIEVHARDWAREERROR event to avoid potential crash.
— IBM
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Avoid potential use-after-free in hcierrorreset
While handling the HCIEVHARDWAREERROR event, if the underlying BT controller is not responding, the GPIO reset mechanism would free the hcidev and lead to a use-after-free in hcierrorreset.
Here's the call trace observed on a ChromeOS device with Intel AX201: queueworkon+0x3e/0x6c hcicmdsyncsk+0x2ee/0x4c0 [bluetooth <HASH:3b4a6>] ? initwaitentry+0x31/0x31 hcicmdsync+0x16/0x20 [bluetooth <HASH:3b4a 6>] hcierrorreset+0x4f/0xa4 [bluetooth <HASH:3b4a 6>] processonework+0x1d8/0x33f workerthread+0x21b/0x373 kthread+0x13a/0x152 ? prcontwork+0x54/0x54 ? kthreadblkcg+0x31/0x31 retfromfork+0x1f/0x30
This patch holds the reference count on the hcidev while processing a HCIEVHARDWAREERROR event to avoid potential crash.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26801?
CVE-2024-26801 has been classified as a high severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-26801?
To mitigate CVE-2024-26801, users should upgrade to the corrected versions of the Linux kernel as specified in the advisory.
Which Linux kernel versions are affected by CVE-2024-26801?
CVE-2024-26801 affects multiple versions, including kernel versions prior to 4.19.309, 5.4.271, 5.10.212, 5.15.151, 6.1.81, and others.
Is there a workaround for CVE-2024-26801?
While the recommended solution is to upgrade, there may not be effective workarounds for CVE-2024-26801.
Where can I find more information about CVE-2024-26801?
Additional details regarding CVE-2024-26801 can typically be found in the official Linux kernel security advisories and release notes.