CVE-2024-56591

MEDIUM

Linux Kernel < 6.12.5 - Use-After-Free in Bluetooth HCI Connection Work Queue

Title source: llm

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Use disable_delayed_work_sync This makes use of disable_delayed_work_sync instead cancel_delayed_work_sync as it not only cancel the ongoing work but also disables new submit which is disarable since the object holding the work is about to be freed.

References (2)

Core 2

Core References

Patch

https://git.kernel.org/stable/c/c55a4c5a04bae40dcdc1e1c19d8eb79a06fb3397

Patch

https://git.kernel.org/stable/c/2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df

Scores

CVSS v3 5.5

EPSS 0.0019

EPSS Percentile 8.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

Status published

Products (8)

linux/Kernel 3.3.0 - 6.12.5linux

Linux/Linux < 3.3

Linux/Linux 19c40e3bcaf2d969f5d4ee85bbe1330b54d36d9c - 2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df

Linux/Linux 19c40e3bcaf2d969f5d4ee85bbe1330b54d36d9c - c55a4c5a04bae40dcdc1e1c19d8eb79a06fb3397

Linux/Linux 3.3

Linux/Linux 6.12.5 - 6.12.*

Linux/Linux 6.13

linux/linux_kernel < 6.12.5

Published Dec 27, 2024

Tracked Since Feb 18, 2026