Riskcovery

CVE-2024-42132

bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX

State
Published
Severity
7.6 High
Published
Jul 30, 2024
Updated
Aug 5, 2026
Reserved
Jul 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX

Syzbot hit warning in hci_conn_del() caused by freeing handle that was not allocated using ida allocator.

This is caused by handle bigger than HCI_CONN_HANDLE_MAX passed by hci_le_big_sync_established_evt(), which makes code think it's unset connection.

Add same check for handle upper bound as in hci_conn_set_handle() to prevent warning.

Scores

CVSSScoreVectorSource
3.17.6 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • f7e83f2278f06b577e3c92ea2f4e8e8c6fc72a8f to before 2ae8d7742a09c275872e670c53337b3dcedaa11cAffected
  • 84cb0143fb8a03bf941c7aaedd56c938c99dafad to before 4970e48f83dbd21d2a6a7cdaaafc2a71f7f45dc4Affected
  • 181a42edddf51d5d9697ecdf365d72ebeab5afb0 to before d311036696fed778301d08a71a4bef737b86d8c5Affected
  • 181a42edddf51d5d9697ecdf365d72ebeab5afb0 to before 1cc18c2ab2e8c54c355ea7c0423a636e415a0c23Affected
  • e9f708beada55426c8d678e2f46af659eb5bf4f0Affected
  • 6.6.2 to before 6.6.39Affected
  • 6.5.12 to before 6.6Affected
LinuxLinux
  • 6.7Affected
  • before 6.7Not affected
  • 6.6.39 through 6.6.*Not affected
  • 6.9.9 through 6.9.*Not affected
  • 6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.