CVE-2024-26888

What it actually does

A memory leak occurs when a buffer allocated for sending an MSFT_OP_LE_MONITOR_ADVERTISEMENT command in the Bluetooth MSFT driver is not properly freed after use.

Why it matters to the business

Prolonged operation of Bluetooth advertisement monitoring on affected Linux systems can gradually exhaust kernel memory, leading to performance degradation, instability, or forced reboots in environments relying on this functionality.

How an attack unfolds

An attacker with local or adjacent access triggers repeated Bluetooth MSFT LE monitor advertisement operations, causing the kernel to allocate buffers without releasing them and eventually depleting available memory.

How to fix it

Update the Linux kernel to include commit 2dde18cd1d8fac735875f2e4987f11817cc0bc2c or any later equivalent fix that properly releases the allocated buffer.

How to confirm the fix worked

Confirm the presence of the fix commit in the kernel source tree; test Bluetooth MSFT advertisement flows while monitoring for buffer leaks using kernel memory debugging tools.

Typical attack path

1. Gain access to trigger Bluetooth operations on the target system
2. Repeatedly invoke MSFT_OP_LE_MONITOR_ADVERTISEMENT command paths
3. Monitor kernel memory consumption until exhaustion occurs
4. Induce denial of service through resource depletion

How to detect it

Review kernel logs and memory statistics for unreleased buffers associated with Bluetooth MSFT operations; employ profiling tools to identify allocation patterns without matching frees.

What your security team should do

• Prioritize kernel updates on all Bluetooth-enabled Linux systems
• Monitor memory usage trends during Bluetooth operations
• Restrict untrusted Bluetooth interactions where feasible