CVE-2024-50124

Bluetooth: ISO: Fix UAF on iso_sock_timeout

State: Published
Severity: 8.0 High
Published: Nov 5, 2024
Updated: Aug 5, 2026
Reserved: Oct 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Fix UAF on iso_sock_timeout

conn->sk maybe have been unlinked/freed while waiting for iso_conn_lock so this checks if the conn->sk is still valid by checking if it part of iso_sk_list.

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	ccf74f2390d60a2f9a75ef496d2564abb478f46a to before 876ac72d535fa94f4ac57bba651987c6f990f646Affected ccf74f2390d60a2f9a75ef496d2564abb478f46a to before 14bcb721d241e62fdd18f6f434a2ed2ab6e71a9bAffected ccf74f2390d60a2f9a75ef496d2564abb478f46a to before d75aad1d3143ca68cda52ff80ac392e1bbd84325Affected ccf74f2390d60a2f9a75ef496d2564abb478f46a to before 246b435ad668596aa0e2bbb9d491b6413861211aAffected
LinuxLinux	6.0Affected before 6.0Not affected 6.1.115 through 6.1.Not affected 6.6.59 through 6.6.Not affected 6.11.6 through 6.11.*Not affected 6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.