CVE-2024-49951 Bluetooth: MGMT: Fix possible crash on mgmt_index_removed
A race condition in the Linux kernel Bluetooth management module can cause a system crash when removing an index while commands are queued.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49951?
CVE-2024-49951 is a high-severity vulnerability in Linux kernel, published on 21 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: Fix possible crash on mgmt_index_removed
If mgmt_index_removed is called while there are commands queued on cmd_sync it could lead to crashes like the bellow trace:
0x0000053D: __list_del_entry_valid_or_report+0x98/0xdc 0x0000053D: mgmt_pending_remove+0x18/0x58 [bluetooth] 0x0000053E: mgmt_remove_adv_monitor_complete+0x80/0x108 [bluetooth] 0x0000053E: hci_cmd_sync_work+0xbc/0x164 [bluetooth]
So while handling mgmt_index_removed this attempts to dequeue commands passed as user_data to cmd_sync.
Which versions are affected by CVE-2024-49951?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-49951?
Apply the vendor's patch.
Is CVE-2024-49951 being exploited?
There is no known exploitation of CVE-2024-49951 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-49951, DEBIAN-CVE-2024-49951, GHSA-x652-w4xg-69jh, UBUNTU-CVE-2024-49951.