CVE-2024-26801

Bluetooth: Avoid potential use-after-free in hci_error_reset

State: Published
Severity: 8.8 High
Published: Apr 4, 2024
Updated: Aug 5, 2026
Reserved: Feb 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Avoid potential use-after-free in hci_error_reset

While handling the HCI_EV_HARDWARE_ERROR event, if the underlying BT controller is not responding, the GPIO reset mechanism would free the hci_dev and lead to a use-after-free in hci_error_reset.

Here's the call trace observed on a ChromeOS device with Intel AX201: queue_work_on+0x3e/0x6c __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth <HASH:3b4a6>] ? init_wait_entry+0x31/0x31 __hci_cmd_sync+0x16/0x20 [bluetooth <HASH:3b4a 6>] hci_error_reset+0x4f/0xa4 [bluetooth <HASH:3b4a 6>] process_one_work+0x1d8/0x33f worker_thread+0x21b/0x373 kthread+0x13a/0x152 ? pr_cont_work+0x54/0x54 ? kthread_blkcg+0x31/0x31 ret_from_fork+0x1f/0x30

This patch holds the reference count on the hci_dev while processing a HCI_EV_HARDWARE_ERROR event to avoid potential crash.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before e0b278650f07acf2e0932149183458468a731c03Affected c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before 98fb98fd37e42fd4ce13ff657ea64503e24b6090Affected c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before 6dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e2Affected c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before da4569d450b193e39e87119fd316c0291b585d14Affected c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before 45085686b9559bfbe3a4f41d3d695a520668f5e1Affected c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before 2ab9a19d896f5a0dd386e1f001c5309bc35f433bAffected c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before dd594cdc24f2e48dab441732e6dfcafd6b0711d1Affected c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before 2449007d3f73b2842c9734f45f0aadb522daf592Affected
LinuxLinux	4.0Affected before 4.0Not affected 4.19.309 through 4.19.Not affected 5.4.271 through 5.4.Not affected 5.10.212 through 5.10.Not affected 5.15.151 through 5.15.Not affected 6.1.81 through 6.1.Not affected 6.6.21 through 6.6.Not affected 6.7.9 through 6.7.*Not affected 6.8 and laterNot affected

Product

Versions

LinuxLinux

c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before e0b278650f07acf2e0932149183458468a731c03Affected
c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before 98fb98fd37e42fd4ce13ff657ea64503e24b6090Affected
c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before 6dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e2Affected
c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before da4569d450b193e39e87119fd316c0291b585d14Affected
c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before 45085686b9559bfbe3a4f41d3d695a520668f5e1Affected
c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before 2ab9a19d896f5a0dd386e1f001c5309bc35f433bAffected
c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before dd594cdc24f2e48dab441732e6dfcafd6b0711d1Affected
c7741d16a57cbf97eebe53f27e8216b1ff20e20c to before 2449007d3f73b2842c9734f45f0aadb522daf592Affected

LinuxLinux

4.0Affected
before 4.0Not affected
4.19.309 through 4.19.*Not affected
5.4.271 through 5.4.*Not affected
5.10.212 through 5.10.*Not affected
5.15.151 through 5.15.*Not affected
6.1.81 through 6.1.*Not affected
6.6.21 through 6.6.*Not affected
6.7.9 through 6.7.*Not affected
6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.