CVE-2024-26886

What it actually does

Race condition in Bluetooth AF socket handling allows sock_lock on recvmsg paths to deadlock with hci_rx_work and l2cap_recv_frame, risking use-after-free when bt_sock_ioctl is invoked concurrently.

Why it matters to the business

Bluetooth subsystems on Linux kernels can hang indefinitely, disrupting wireless device connectivity, audio, and input services until the affected system is rebooted or the worker threads unblock.

How an attack unfolds

An attacker within Bluetooth range sends crafted L2CAP frames that trigger concurrent recvmsg and ioctl operations on the same socket; the resulting lock ordering violation blocks hci_rx_work, leading to prolonged unresponsiveness and potential memory corruption if the socket is freed during the deadlock window.

How to fix it

Update the Linux kernel to commit df0cc57e057f18e44dac8e6c18aba47ab53202f9 or later; rebuild and deploy the patched kernel image across all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit df0cc57e057f18e44dac8e6c18aba47ab53202f9 via git describe or uname output, then exercise Bluetooth receive and ioctl paths under concurrent load to confirm absence of deadlock.

Typical attack path

1. Establish a Bluetooth connection to the target device
2. Send specially timed L2CAP frames that invoke l2cap_sock_recv_cb while bt_sock_ioctl holds a conflicting lock
3. Trigger the deadlock in hci_rx_work queue, blocking the socket for >30 seconds
4. Attempt socket teardown to induce use-after-free

How to detect it

Search kernel logs and dmesg for the exact deadlock backtrace containing __lock_sock, l2cap_sock_recv_cb, l2cap_recv_frame, hci_rx_work, and worker_thread; correlate with Bluetooth activity timestamps.

• INFO: task kworker/u9:1 blocked for more than 30 seconds
• Workqueue: hci0 hci_rx_work
• Call Trace: __lock_sock+0x68/0xa0 l2cap_sock_recv_cb+0x21/0xa0 l2cap_recv_frame+0x55b/0x30a0 hci_rx_work+0x33a/0x3f0

What your security team should do

• Prioritize kernel upgrade to df0cc57e057f18e44dac8e6c18aba47ab53202f9 on all Bluetooth-enabled hosts
• Monitor kernel logs for prolonged hci_rx_work stalls as an interim indicator
• Disable Bluetooth interfaces where not required until patches are applied