CVE-2024-26801

Bluetooth: Avoid potential use-after-free in hci_error_reset

MEDIUM

5.5

CVSS Score

Published: April 4, 2024 at 08:20 AM UTC

Updated: August 5, 2026 at 12:04 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Avoid potential use-after-free in hci_error_reset While handling the HCI_EV_HARDWARE_ERROR event, if the underlying BT controller is not responding, the GPIO reset mechanism would free the hci_dev and lead to a use-after-free in hci_error_reset. Here's the call trace observed on a ChromeOS device with Intel AX201: queue_work_on+0x3e/0x6c __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth <HASH:3b4a6>] ? init_wait_entry+0x31/0x31 __hci_cmd_sync+0x16/0x20 [bluetooth <HASH:3b4a 6>] hci_error_reset+0x4f/0xa4 [bluetooth <HASH:3b4a 6>] process_one_work+0x1d8/0x33f worker_thread+0x21b/0x373 kthread+0x13a/0x152 ? pr_cont_work+0x54/0x54 ? kthread_blkcg+0x31/0x31 ret_from_fork+0x1f/0x30 This patch holds the reference count on the hci_dev while processing a HCI_EV_HARDWARE_ERROR event to avoid potential crash.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

4.0 ≤ v < 4.19.3094.0 ≤ v < 5.10.2124.0 ≤ v < 5.15.1514.0 ≤ v < 5.4.2714.0 ≤ v < 6.1.814.0 ≤ v < 6.6.214.0 ≤ v < 6.7.94.0 ≤ v < 6.84.20 ≤ v < 5.4.2715.11 ≤ v < 5.15.1515.16 ≤ v < 6.1.815.5 ≤ v < 5.10.2126.2 ≤ v < 6.6.216.7 ≤ v < 6.7.96.8 rc1 6.8 rc2 6.8 rc3 6.8 rc4 6.8 rc5 6.8 rc6c7741d16a57cbf97eebe53f27e8216b1ff20e20c

Vendor states this is fixed in 2449007d3f73b2842c9734f45f0aadb522daf592 (fixed)

Vendor states this is fixed in 2ab9a19d896f5a0dd386e1f001c5309bc35f433b (fixed)

Vendor states this is fixed in 45085686b9559bfbe3a4f41d3d695a520668f5e1 (fixed)

Vendor states this is fixed in 6dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e2 (fixed)

Vendor states this is fixed in 98fb98fd37e42fd4ce13ff657ea64503e24b6090 (fixed)

Vendor states this is fixed in da4569d450b193e39e87119fd316c0291b585d14 (fixed)

Vendor states this is fixed in dd594cdc24f2e48dab441732e6dfcafd6b0711d1 (fixed)

Vendor states this is fixed in e0b278650f07acf2e0932149183458468a731c03 (fixed)

Vendor states this is fixed in 4.0 (unaffected)

Vendor states this is fixed in 4.19.309 (unaffected)

Vendor states this is fixed in 5.10.212 (unaffected)

Vendor states this is fixed in 5.15.151 (unaffected)