CVE-2024-22099

What it actually does

NULL pointer dereference in /net/bluetooth/rfcomm/core.c of the Linux kernel Bluetooth stack that can result in memory corruption or denial of service when processing crafted RFCOMM frames on x86 or ARM systems.

Why it matters to the business

Linux systems using Bluetooth may experience crashes or service disruption; the flaw affects an extremely old kernel version with no listed fixes, increasing operational risk for any remaining legacy deployments.

How an attack unfolds

An attacker with local network access to a Bluetooth interface sends specially crafted RFCOMM packets that reach the vulnerable code path in rfcomm/core.c, triggering the null dereference and resulting in a kernel panic or memory corruption.

How to fix it

Upgrade the Linux kernel to a version that resolves the null dereference in the RFCOMM module; if upgrade is impossible, disable the Bluetooth RFCOMM module or Bluetooth entirely until the system can be updated.

How to confirm the fix worked

Verify the running kernel version is newer than v2.6.12-rc2 and that the rfcomm module has been rebuilt or replaced with a patched binary; test Bluetooth functionality under load to confirm absence of crashes.

Typical attack path

1. Obtain network proximity or access to target Bluetooth interface
2. Send crafted RFCOMM frames targeting the core.c handling logic
3. Trigger null pointer dereference leading to kernel instability

How to detect it

Review kernel logs for oops or panic entries referencing rfcomm/core.c or bluetooth; inspect network traffic for anomalous RFCOMM frames on Bluetooth interfaces.

What your security team should do

• Identify all systems still running kernel versions at or near v2.6.12-rc2 and prioritize replacement or upgrade
• Disable Bluetooth where not required to reduce attack surface
• Monitor for kernel oops or panic logs related to rfcomm