vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2024-26886

Bluetooth: af_bluetooth: Fix deadlock

MEDIUM
6.5
CVSS Score
Published: April 17, 2024 at 10:27 AM UTC
Updated: October 30, 2026 at 01:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.5
Exploit prediction
EPSS 0.5%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: af_bluetooth: Fix deadlock Attemting to do sock_lock on .recvmsg may cause a deadlock as shown bellow, so instead of using sock_sock this uses sk_receive_queue.lock on bt_sock_ioctl to avoid the UAF: INFO: task kworker/u9:1:121 blocked for more than 30 seconds. Not tainted 6.7.6-lemon #183 Workqueue: hci0 hci_rx_work Call Trace: <TASK> __schedule+0x37d/0xa00 schedule+0x32/0xe0 __lock_sock+0x68/0xa0 ? __pfx_autoremove_wake_function+0x10/0x10 lock_sock_nested+0x43/0x50 l2cap_sock_recv_cb+0x21/0xa0 l2cap_recv_frame+0x55b/0x30a0 ? psi_task_switch+0xeb/0x270 ? finish_task_switch.isra.0+0x93/0x2a0 hci_rx_work+0x33a/0x3f0 process_one_work+0x13a/0x2f0 worker_thread+0x2f0/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xe0/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
5.10.206 ≤ v < 5.115.15.146 ≤ v < 5.166.1.70 ≤ v < 6.1.836.6.9 ≤ v < 6.6.236.7 ≤ v < 6.7.116.8 ≤ v < 6.8.21d576c3a5af850bf11fbd103f9ba11aa6d6061fb2b16d960c79abc397f102c3d23d30005b68cb0362e07e8348ea454615e268222ae3fc240421be76837f71e2c9f515834841826f4eb68ec33cfb2a1ff5.10.2065.15.1466.1.706.6.96.7db1b14eec8c61a20374de9f9c2ddc6c9406a8c42
Vendor states this is fixed in 2c9e2df022ef8b9d7fac58a04a2ef4ed25288955 (fixed)
Vendor states this is fixed in 60673f442984fe689d4127a5dd4be414247b3d67 (fixed)
Vendor states this is fixed in 64be3c6154886200708da0dfe259705fb992416c (fixed)
Vendor states this is fixed in 817e8138ce86001b2fa5c63d6ede756e205a01f7 (fixed)
Vendor states this is fixed in f7b94bdc1ec107c92262716b073b3e816d4784fb (fixed)
Affected range stops below 5.11, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.15.209 (unaffected)
Affected range stops below 5.16, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 6.1.191 (unaffected)
Affected range stops below 6.1.83, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.2, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 6.6.23 (unaffected)
Vendor states this is fixed in 6.7 (unaffected)
Vendor states this is fixed in 6.7.11 (unaffected)
Vendor states this is fixed in 6.8.2 (unaffected)
Vendor states this is fixed in 6.9 (unaffected)

References (7)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2c9e2df022ef8b9d7fac58a04a2ef4ed25288955
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/64be3c6154886200708da0dfe259705fb992416c
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/817e8138ce86001b2fa5c63d6ede756e205a01f7
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f7b94bdc1ec107c92262716b073b3e816d4784fb
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
https://git.kernel.org/stable/c/cb8adca52f306563d958a863bb0cbae9c184d1ae
Source: cverecord
https://git.kernel.org/stable/c/60673f442984fe689d4127a5dd4be414247b3d67
Source: cverecord
https://git.kernel.org/stable/c/0309acebc4b3884bfda332558bb8a1df052f4f39

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.5MEDIUMCISA-ADP
Attack Vector
ADJACENT_NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-416

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card