{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-58009",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2024-58009"
  ],
  "published": "2025-02-27T02:12:01Z",
  "summary": "Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc\n\nA NULL sock pointer is passed into l2cap_sock_alloc() when it is called\nfrom l2cap_sock_new_connection_cb() and the error handling paths should\nalso be aware of it.\n\nSeemingly a more elegant solution would be to swap bt_sock_alloc() and\nl2cap_chan_create() calls since they are not interdependent to that moment\nbut then l2cap_chan_create() adds the soon to be deallocated and still\ndummy-initialized channel to the global list accessible by many L2CAP\npaths. The channel would be removed from the list in short period of time\nbut be a bit more straight-forward here and just check for NULL instead of\nchanging the order of function calls.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE static\nanalysis tool.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.6.74-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.6.74+rpt-rpi-2712",
            "binary_version": "1:6.6.74-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.74+rpt-rpi-v6",
            "binary_version": "1:6.6.74-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.74+rpt-rpi-v7",
            "binary_version": "1:6.6.74-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.74+rpt-rpi-v7l",
            "binary_version": "1:6.6.74-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.74+rpt-rpi-v8",
            "binary_version": "1:6.6.74-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.6.74-1+rpt1": {
            "linux_commit": "a18d9ced4965462cb7b3b4252ada440395105308",
            "upstream_version": "6.6.74",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.78"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58009"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a9a7672fc1a0fe18502493936ccb06413ab89ea6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/8e605f580a97530e5a3583beea458a3fa4cbefbd"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cf601a24120c674cd7c907ea695f92617af6abd0"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/297ce7f544aa675b0d136d788cad0710cdfb0785"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/245d48c1ba3e7a1779c2f4cbc6f581ddc8a78e22"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/691218a50c3139f7f57ffa79fb89d932eda9571e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/49c0d55d59662430f1829ae85b969619573d0fa1"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-05-24T06:48:58Z"
  }
}