PT-2024-32109 · Linux+5 · Linux Kernel+5
Published
2024-08-23
·
Updated
2025-09-29
·
CVE-2024-46680
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.9.11
Description
The Linux kernel has a vulnerability in the Bluetooth module, specifically in the btnxpuart driver. The issue arises when the driver is removed while the Power Save feature is enabled, causing a kernel crash. This happens because the ps wakeup() call in btnxpuart close() schedules a work item that gets executed after the module is removed. The new ps cleanup() function fixes this by immediately deasserting the UART break, canceling any scheduled work, and destroying the ps lock mutex when the serdev device is closed.
Recommendations
To resolve this issue, update the Linux kernel to a version that includes the fix for this vulnerability. Specifically, versions 6.9.11 and later should be used. For versions prior to 6.9.11, consider applying the patch that includes the new ps cleanup() function to mitigate the issue. As a temporary workaround, consider disabling the Power Save feature by default to minimize the risk of exploitation until a patch is available.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu