CVE-2021-3564

What it actually does

Double-free memory corruption during HCI device initialization in the Linux kernel Bluetooth subsystem when a malicious HCI TTY device is attached by a local user, resulting in kernel memory corruption and system crash (availability impact only).

Why it matters to the business

Local users can intentionally or accidentally cause complete system crashes on affected Linux servers, desktops, or embedded devices, leading to downtime, loss of availability, and potential data loss for workloads running on those systems; widespread exposure across server and IoT fleets increases operational risk.

How an attack unfolds

An attacker with local shell access creates or emulates a malicious HCI TTY Bluetooth device and attaches it to the kernel's HCI subsystem; the double-free occurs during initialization, corrupting kernel memory and triggering a panic. Public exploit code exists and the flaw has been referenced in Android kernel race-condition research contexts.

How to fix it

Upgrade the Linux kernel to a version that contains the fix for the HCI initialization double-free (all releases starting from 3.13 are affected until patched); disable Bluetooth HCI TTY support via kernel configuration or module blacklisting if the functionality is unused; apply distribution updates from Fedora, Debian, or other vendors that back-port the correction.

How to confirm the fix worked

Verify running kernel version is newer than the last affected 3.13-era release and that the HCI double-free code path has been removed or hardened; attempt to reproduce the crash with a safe test device in a lab environment or review kernel source for the corrected hci_ldisc.c initialization logic.

Typical attack path

1. Obtain local unprivileged shell on target Linux system
2. Prepare or attach a crafted HCI TTY Bluetooth device node
3. Trigger HCI device initialization code path
4. Cause kernel double-free and panic to achieve denial of service

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for HCI-related initialization failures, double-free warnings, or Bluetooth TTY oops/panics; correlate with user sessions that recently accessed /dev/tty* or hci devices.

What your security team should do

• Prioritize kernel upgrades on all internet-facing or multi-tenant Linux systems within the next patching cycle
• Restrict local user access and Bluetooth device attachment privileges via udev rules or group membership
• Monitor for kernel oops and panic reports mentioning HCI or Bluetooth TTY
• Consider disabling unused Bluetooth subsystems at build or boot time