CVE-2024-26801

What it actually does

Use-after-free in the Linux kernel Bluetooth HCI subsystem during HCI_EV_HARDWARE_ERROR handling when a non-responsive controller triggers GPIO reset that frees hci_dev while hci_error_reset still references it.

Why it matters to the business

Linux systems using Bluetooth may experience kernel crashes or instability, leading to device downtime and potential data loss in environments reliant on wireless connectivity.

How an attack unfolds

An attacker triggers a hardware error event on the Bluetooth controller, causing the error reset path to attempt operations on a freed hci_dev object after GPIO reset releases the device reference.

How to fix it

Update the Linux kernel to the fixed commit e0b278650f07acf2e0932149183458468a731c03 or later stable versions containing this change.

How to confirm the fix worked

Confirm the kernel source contains the reference count hold on hci_dev during HCI_EV_HARDWARE_ERROR processing and verify no use-after-free paths remain in hci_error_reset.

Typical attack path

1. Trigger HCI_EV_HARDWARE_ERROR event on Bluetooth controller
2. Force controller non-responsiveness to invoke GPIO reset
3. hci_error_reset executes on freed hci_dev reference
4. Kernel use-after-free leads to crash or potential code execution

How to detect it

Review kernel logs for Bluetooth HCI error reset call traces and worker thread crashes involving hci_dev; inspect for signs of forced hardware error events in dmesg or system logs.

What your security team should do

• Prioritize kernel updates on all Bluetooth-enabled Linux systems
• Monitor for kernel oops or crashes related to Bluetooth HCI error handling
• Disable Bluetooth if not required until patched