CVE-2024-49951

MEDIUM

Linux Kernel - Denial of Service via Bluetooth MGMT Index Removal

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed If mgmt_index_removed is called while there are commands queued on cmd_sync it could lead to crashes like the bellow trace: 0x0000053D: __list_del_entry_valid_or_report+0x98/0xdc 0x0000053D: mgmt_pending_remove+0x18/0x58 [bluetooth] 0x0000053E: mgmt_remove_adv_monitor_complete+0x80/0x108 [bluetooth] 0x0000053E: hci_cmd_sync_work+0xbc/0x164 [bluetooth] So while handling mgmt_index_removed this attempts to dequeue commands passed as user_data to cmd_sync.

References (6)

Core 6

Scores

CVSS v3 5.5
EPSS 0.0024
EPSS Percentile 14.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

Status published
Products (18)
linux/Kernel 6.0.0 - 6.1.120linux
linux/Kernel 6.11.0 - 6.11.3linux
linux/Kernel 6.2.0 - 6.6.55linux
linux/Kernel 6.7.0 - 6.10.14linux
Linux/Linux < 6.0
Linux/Linux 6.0
Linux/Linux 6.1.120 - 6.1.*
Linux/Linux 6.10.14 - 6.10.*
Linux/Linux 6.11.3 - 6.11.*
Linux/Linux 6.12
... and 8 more
Published Oct 21, 2024
Tracked Since Feb 18, 2026