CVE-2024-58009

Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc

State: Published
Severity: Not scored
Published: Feb 27, 2025
Updated: Oct 15, 2026
Reserved: Feb 27, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc

A NULL sock pointer is passed into l2cap_sock_alloc() when it is called from l2cap_sock_new_connection_cb() and the error handling paths should also be aware of it.

Seemingly a more elegant solution would be to swap bt_sock_alloc() and l2cap_chan_create() calls since they are not interdependent to that moment but then l2cap_chan_create() adds the soon to be deallocated and still dummy-initialized channel to the global list accessible by many L2CAP paths. The channel would be removed from the list in short period of time but be a bit more straight-forward here and just check for NULL instead of changing the order of function calls.

Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f6ad641646b67f29c7578dcd6c25813c7dcbf51e to before a9a7672fc1a0fe18502493936ccb06413ab89ea6Affected daa13175a6dea312a76099066cb4cbd4fc959a84 to before 8e605f580a97530e5a3583beea458a3fa4cbefbdAffected a8677028dd5123e5e525b8195483994d87123de4 to before cf601a24120c674cd7c907ea695f92617af6abd0Affected bb2f2342a6ddf7c04f9aefbbfe86104cd138e629 to before 297ce7f544aa675b0d136d788cad0710cdfb0785Affected 8ad09ddc63ace3950ac43db6fbfe25b40f589dd6 to before 245d48c1ba3e7a1779c2f4cbc6f581ddc8a78e22Affected 61686abc2f3c2c67822aa23ce6f160467ec83d35 to before 691218a50c3139f7f57ffa79fb89d932eda9571eAffected 7c4f78cdb8e7501e9f92d291a7d956591bf73be9 to before 49c0d55d59662430f1829ae85b969619573d0fa1Affected 7c4f78cdb8e7501e9f92d291a7d956591bf73be9 to before 5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1Affected 5.4.287 to before 5.4.291Affected 5.10.231 to before 5.10.235Affected 5.15.174 to before 5.15.179Affected 6.1.120 to before 6.1.129Affected 6.6.66 to before 6.6.78Affected 6.12.5 to before 6.12.14Affected
LinuxLinux	6.13Affected before 6.13Not affected 5.4.291 through 5.4.Not affected 5.10.235 through 5.10.Not affected 5.15.179 through 5.15.Not affected 6.1.129 through 6.1.Not affected 6.6.78 through 6.6.Not affected 6.12.14 through 6.12.Not affected 6.13.3 through 6.13.*Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

f6ad641646b67f29c7578dcd6c25813c7dcbf51e to before a9a7672fc1a0fe18502493936ccb06413ab89ea6Affected
daa13175a6dea312a76099066cb4cbd4fc959a84 to before 8e605f580a97530e5a3583beea458a3fa4cbefbdAffected
a8677028dd5123e5e525b8195483994d87123de4 to before cf601a24120c674cd7c907ea695f92617af6abd0Affected
bb2f2342a6ddf7c04f9aefbbfe86104cd138e629 to before 297ce7f544aa675b0d136d788cad0710cdfb0785Affected
8ad09ddc63ace3950ac43db6fbfe25b40f589dd6 to before 245d48c1ba3e7a1779c2f4cbc6f581ddc8a78e22Affected
61686abc2f3c2c67822aa23ce6f160467ec83d35 to before 691218a50c3139f7f57ffa79fb89d932eda9571eAffected
7c4f78cdb8e7501e9f92d291a7d956591bf73be9 to before 49c0d55d59662430f1829ae85b969619573d0fa1Affected
7c4f78cdb8e7501e9f92d291a7d956591bf73be9 to before 5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1Affected
5.4.287 to before 5.4.291Affected
5.10.231 to before 5.10.235Affected
5.15.174 to before 5.15.179Affected
6.1.120 to before 6.1.129Affected
6.6.66 to before 6.6.78Affected
6.12.5 to before 6.12.14Affected

LinuxLinux

6.13Affected
before 6.13Not affected
5.4.291 through 5.4.*Not affected
5.10.235 through 5.10.*Not affected
5.15.179 through 5.15.*Not affected
6.1.129 through 6.1.*Not affected
6.6.78 through 6.6.*Not affected
6.12.14 through 6.12.*Not affected
6.13.3 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.