CVE-2024-26887

What it actually does

Memory leak in btusb driver when CONFIG_DEV_COREDUMP is enabled; skb is cloned without corresponding free in btmtk_process_coredump path.

Why it matters to the business

Gradual memory exhaustion on Linux systems using Bluetooth, potentially causing performance degradation or denial of service after prolonged operation.

How an attack unfolds

An attacker triggers repeated Bluetooth coredump processing paths that allocate skb clones without release, slowly consuming kernel memory until the system becomes unstable.

How to fix it

Update the Linux kernel to the fixed commit 620b9e60e4b55fa55540ce852a0f3c9e6091dbbc or later stable release containing the btusb memory leak fix.

How to confirm the fix worked

Verify kernel source contains the CONFIG_DEV_COREDUMP guard before skb clone and confirm btmtk_process_coredump releases the passed skb; test with Bluetooth coredump scenarios.

Typical attack path

1. Establish Bluetooth connection to trigger driver activity
2. Induce conditions that invoke coredump handling in btusb
3. Repeat to accumulate leaked skb allocations
4. Monitor until memory pressure leads to system impact

How to detect it

Review kernel memory statistics and slab allocator usage for unusual skb growth correlated with Bluetooth activity; examine logs for repeated btusb coredump events.

What your security team should do

• Prioritize kernel upgrade on systems with Bluetooth enabled
• Monitor memory usage on affected hosts for anomalous growth
• Disable CONFIG_DEV_COREDUMP if coredump functionality is not required