CVE-2024-36012

Bluetooth: msft: fix slab-use-after-free in msft_do_close()

State: Published
Severity: 7.8 High
Published: May 23, 2024
Updated: Aug 5, 2026
Reserved: May 17, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: msft: fix slab-use-after-free in msft_do_close()

Tying the msft->data lifetime to hdev by freeing it in hci_release_dev() to fix the following case:

[use] msft_do_close() msft = hdev->msft_data; if (!msft) ...(1) <- passed. return; mutex_lock(&msft->filter_lock); ...(4) <- used after freed.

[free] msft_unregister() msft = hdev->msft_data; hdev->msft_data = NULL; ...(2) kfree(msft); ...(3) <- msft is freed.

================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f/0xc30 kernel/locking/mutex.c:752 Read of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	bf6a4e30ffbd9e9ef8934582feb937f6532f8b68 to before e3880b531b68f98d3941d83f2f6dd11cf4fd6b76Affected bf6a4e30ffbd9e9ef8934582feb937f6532f8b68 to before a85a60e62355e3bf4802dead7938966824b23940Affected bf6a4e30ffbd9e9ef8934582feb937f6532f8b68 to before 4f1de02de07748da80a8178879bc7a1df37fdf56Affected bf6a4e30ffbd9e9ef8934582feb937f6532f8b68 to before 10f9f426ac6e752c8d87bf4346930ba347aaabacAffected
LinuxLinux	5.12Affected before 5.12Not affected 6.1.91 through 6.1.Not affected 6.6.31 through 6.6.Not affected 6.8.10 through 6.8.*Not affected 6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.