PT-2024-32166 · Linux+5 · Linux Kernel+5
Published
2024-05-15
·
Updated
2026-05-26
·
CVE-2024-46749
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.52
Description
A null pointer dereference vulnerability was found in the Linux kernel's Bluetooth subsystem, specifically in the btnxpuart flush() function. This vulnerability can cause a kernel crash when removing the driver after a firmware download fails or before the firmware download completes. The vulnerability is due to a lack of checks before freeing the rx->skb in flush and close functions.
Recommendations
To resolve this issue, update the Linux kernel to version 6.6.52 or later. As a temporary workaround, consider disabling the btnxpuart flush() function until a patch is available. Restrict access to the vulnerable Bluetooth subsystem to minimize the risk of exploitation. Avoid using the affected API endpoints until the issue is resolved.
Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Suse
Ubuntu