{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-41063",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2024-41063"
  ],
  "published": "2024-07-29T14:58:20Z",
  "summary": "Bluetooth: hci_core: cancel all works upon hci_unregister_dev()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: cancel all works upon hci_unregister_dev()\n\nsyzbot is reporting that calling hci_release_dev() from hci_error_reset()\ndue to hci_dev_put() from hci_error_reset() can cause deadlock at\ndestroy_workqueue(), for hci_error_reset() is called from\nhdev->req_workqueue which destroy_workqueue() needs to flush.\n\nWe need to make sure that hdev->{rx_work,cmd_work,tx_work} which are\nqueued into hdev->workqueue and hdev->{power_on,error_reset} which are\nqueued into hdev->req_workqueue are no longer running by the moment\n\n       destroy_workqueue(hdev->workqueue);\n       destroy_workqueue(hdev->req_workqueue);\n\nare called from hci_release_dev().\n\nCall cancel_work_sync() on these work items from hci_unregister_dev()\nas soon as hdev->list is removed from hci_dev_list.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.6.28-1+rpt1",
        "1:6.6.31-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-2712",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-v6",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-v7",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-v7l",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-v8",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-2712",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v6",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v7",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v7l",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v8",
            "binary_version": "1:6.6.31-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.6.28-1+rpt1": {
            "linux_commit": "0c341f47adc3578cd5f817aa20ee2b7f9ae6b23e",
            "upstream_version": "6.6.28",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.42"
          },
          "1:6.6.31-1+rpt1": {
            "linux_commit": "c1432b4bae5b6582f4d32ba381459f33c34d1424",
            "upstream_version": "6.6.31",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.42"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41063"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/48542881997e17b49dc16b93fe910e0cfcf7a9f9"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9cfc84b1d464cc024286f42a090718f9067b80ed"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ddeda6ca5f218b668b560d90fc31ae469adbfd92"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d2ce562a5aff1dcd0c50d9808ea825ef90da909f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/96600c2e5ee8213dbab5df1617293d8e847bb4fa"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d6cbce18370641a21dd889e8613d8153df15eb39"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3f939bd73fed12dddc2a32a76116c19ca47c7678"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0d151a103775dd9645c78c97f77d6e2a5298d913"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-05-24T06:48:58Z"
  }
}