{ "schema_version": "1.6.1", "id": "RPI-CVE-2024-58241", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2024-58241" ], "published": "2025-09-24T11:03:09Z", "summary": "Bluetooth: hci_core: Disable works on hci_unregister_dev", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Disable works on hci_unregister_dev\n\nThis make use of disable_work_* on hci_unregister_dev since the hci_dev is\nabout to be freed new submissions are not disarable.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.6.47-1+rpt1", "1:6.6.51-1+rpt1", "1:6.6.51-1+rpt2", "1:6.6.51-1+rpt3", "1:6.6.62-1+rpt1", "1:6.6.74-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.6.47+rpt-rpi-2712", "binary_version": "1:6.6.47-1+rpt1" }, { "binary_name": "linux-image-6.6.47+rpt-rpi-v6", "binary_version": "1:6.6.47-1+rpt1" }, { "binary_name": "linux-image-6.6.47+rpt-rpi-v7", "binary_version": "1:6.6.47-1+rpt1" }, { "binary_name": "linux-image-6.6.47+rpt-rpi-v7l", "binary_version": "1:6.6.47-1+rpt1" }, { "binary_name": "linux-image-6.6.47+rpt-rpi-v8", "binary_version": "1:6.6.47-1+rpt1" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-2712", "binary_version": "1:6.6.51-1+rpt1" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v6", "binary_version": "1:6.6.51-1+rpt1" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v7", "binary_version": "1:6.6.51-1+rpt1" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v7l", "binary_version": "1:6.6.51-1+rpt1" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v8", "binary_version": "1:6.6.51-1+rpt1" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-2712", "binary_version": "1:6.6.51-1+rpt2" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v6", "binary_version": "1:6.6.51-1+rpt2" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v7", "binary_version": "1:6.6.51-1+rpt2" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v7l", "binary_version": "1:6.6.51-1+rpt2" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v8", "binary_version": "1:6.6.51-1+rpt2" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-2712", "binary_version": "1:6.6.51-1+rpt3" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v6", "binary_version": "1:6.6.51-1+rpt3" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v7", "binary_version": "1:6.6.51-1+rpt3" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v7l", "binary_version": "1:6.6.51-1+rpt3" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v8", "binary_version": "1:6.6.51-1+rpt3" }, { "binary_name": "linux-image-6.6.62+rpt-rpi-2712", "binary_version": "1:6.6.62-1+rpt1" }, { "binary_name": "linux-image-6.6.62+rpt-rpi-v6", "binary_version": "1:6.6.62-1+rpt1" }, { "binary_name": "linux-image-6.6.62+rpt-rpi-v7", "binary_version": "1:6.6.62-1+rpt1" }, { "binary_name": "linux-image-6.6.62+rpt-rpi-v7l", "binary_version": "1:6.6.62-1+rpt1" }, { "binary_name": "linux-image-6.6.62+rpt-rpi-v8", "binary_version": "1:6.6.62-1+rpt1" }, { "binary_name": "linux-image-6.6.74+rpt-rpi-2712", "binary_version": "1:6.6.74-1+rpt1" }, { "binary_name": "linux-image-6.6.74+rpt-rpi-v6", "binary_version": "1:6.6.74-1+rpt1" }, { "binary_name": "linux-image-6.6.74+rpt-rpi-v7", "binary_version": "1:6.6.74-1+rpt1" }, { "binary_name": "linux-image-6.6.74+rpt-rpi-v7l", "binary_version": "1:6.6.74-1+rpt1" }, { "binary_name": "linux-image-6.6.74+rpt-rpi-v8", "binary_version": "1:6.6.74-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.6.47-1+rpt1": { "linux_commit": "cf64a1dfecc2dc418efdd61701c1a4b185ab4761", "upstream_version": "6.6.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null }, "1:6.6.51-1+rpt1": { "linux_commit": "0094eba3f2a4338cfa6854b0b5104d02ba0fa01f", "upstream_version": "6.6.51", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null }, "1:6.6.51-1+rpt2": { "linux_commit": "82a50e430ef1d6eb37d78e25aa572c1f6ea56160", "upstream_version": "6.6.51", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null }, "1:6.6.51-1+rpt3": { "linux_commit": "5aeecea9f4a45248bcf564dec924965e066a7bfd", "upstream_version": "6.6.51", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null }, "1:6.6.62-1+rpt1": { "linux_commit": "dd2394360860d15146c96635796a75b05bb32b61", "upstream_version": "6.6.62", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null }, "1:6.6.74-1+rpt1": { "linux_commit": "a18d9ced4965462cb7b3b4252ada440395105308", "upstream_version": "6.6.74", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2024-58241" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/cfdb13a54e05eb98d9940cb6d1a13e7f994d811f" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/989fa5171f005ecf63440057218d8aeb1795287d" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T11:52:36Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - Triggering the vulnerable window requires initiating HCI device teardown (`hci_unregister_dev()`), reachable locally via `/dev/vhci` close, HCI ldisc detach, or adapter down/removal \u2014 an adjacent Bluetooth peer can influence HCI traffic but cannot cause device unregistration. All required primitives are local syscalls (open/write/close/ioctl on a device node and Bluetooth sockets).\nAC:L - The attacker controls both sides of the race \u2014 it drives the unregister (closing the vhci fd) while concurrently feeding HCI packets/commands that re-queue `rx_work`/`cmd_work`/`error_reset` \u2014 and can retry the open/close cycle indefinitely to win it and to spray the freed `hci_dev` slab. The `cmd_timer`/`ncmd_timer` re-arm even occurs on the unregister path itself via `hci_dev_close_sync()`, requiring no external timing luck.\nPR:L - No capability check exists anywhere on the path: `vhci_open()` performs no `capable()` test, so an unprivileged user granted the device node (containers, Android's bluetooth uid, permissive udev rules) can create and destroy HCI devices and inject HCI frames at will. This matches the PR:L assignment for the structurally identical `hci_unregister_dev` teardown UAF CVE-2025-38250.\nUI:N - The attacker performs both the device teardown and the concurrent work re-submission entirely from its own processes. No victim action or cooperation is needed.\nS:U - The corruption is confined to kernel slab memory and workqueue structures within the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - A work_struct/delayed_work embedded in the freed `hci_dev` is dereferenced after `kfree()`, and `__queue_work()` follows the stale `dwork->wq` pointer into a destroyed workqueue. Controlled reallocation of the freed object turns this into an arbitrary-read primitive and leaks kernel pointers/heap contents.\nI:H - The same use-after-free lets the attacker place controlled data in the reclaimed `hci_dev` slab so that the firing timer operates on attacker-supplied `workqueue_struct`/`pool_workqueue`/list pointers and work function pointers, yielding arbitrary write and control-flow hijack. Per kernel scoring guidance, a UAF exploitable for heap spraying is High integrity impact.\nA:H - Even unexploited, the stale timer queuing onto a destroyed workqueue causes a KASAN slab-use-after-free oops and kernel panic, and `destroy_workqueue()` with still-pending work triggers a WARN and leaves the workqueue broken. Re-queued `error_reset` additionally reintroduces the `destroy_workqueue()` self-flush deadlock that hangs the req_workqueue." } } }