CVE-2024-26889

What it actually does

Possible buffer overflow in struct hci_dev_info when hdev->name exceeds the fixed 8-byte name[8] field due to unsafe use of strcpy instead of a bounded copy function.

Why it matters to the business

Can cause system crashes or instability on Linux systems using Bluetooth, leading to downtime and reduced availability for servers, desktops, and embedded devices.

How an attack unfolds

An attacker with local access configures a Bluetooth device name longer than 8 bytes then triggers hci_dev_info retrieval in the kernel HCI core, causing strcpy to write past the fixed buffer boundary.

How to fix it

Update the Linux kernel to a version containing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff which replaces strcpy with strscpy for the name field.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit; attempt to set a device name longer than 8 bytes and query hci_dev_info to verify no overflow occurs.

Typical attack path

1. Obtain local user access on a Linux system
2. Set a Bluetooth device name exceeding 8 characters via HCI interface
3. Trigger device information query through hci_core
4. Induce buffer overflow resulting in kernel panic or denial of service

How to detect it

Inspect system logs for kernel oops, panics, or stack traces referencing hci_core or Bluetooth buffer operations around the time of suspected incidents.

What your security team should do

• Apply the kernel patch or upgrade to a fixed version as soon as possible
• Review and restrict unnecessary local Bluetooth access on affected systems
• Monitor kernel logs for Bluetooth-related crashes until patches are deployed