CVE-2024-26903

What it actually does

Null pointer dereference in rfcomm_check_security when a delayed HCI encryption key size response arrives after L2CAP/RFCOMM disconnection has released the l2cap_conn structure, causing access to conn->hcon on a closed socket.

Why it matters to the business

Kernel crashes or denial of service on Linux systems performing Bluetooth operations, leading to unplanned reboots, loss of unsaved work, and temporary unavailability of Bluetooth-dependent services.

How an attack unfolds

An attacker interacts with the Bluetooth stack to establish an RFCOMM connection, then manipulates timing so that an HCI Command Complete response arrives after L2CAP and RFCOMM layers have disconnected but before HCI cleanup; this causes rfcomm_recv_frame to invoke rfcomm_check_security on a freed structure and dereference a null pointer.

How to fix it

Upgrade the Linux kernel to a version containing commit 369f419c097e82407dd429a202cde9a73d3ae29b or later; apply the patch that adds a BT_CLOSED state check before calling rfcomm_recv_frame in rfcomm_process_rx.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit or a backport; exercise Bluetooth connect/disconnect sequences under timing stress to verify absence of null dereference crashes.

Typical attack path

1. Initiate RFCOMM connection over Bluetooth
2. Trigger L2CAP and RFCOMM disconnection
3. Delay delivery of HCI encryption key size response
4. Invoke rfcomm_recv_frame on the now-closed socket
5. Execute rfcomm_check_security accessing released conn->hcon

How to detect it

Inspect kernel logs and dmesg output for null pointer dereference faults in the Bluetooth RFCOMM subsystem during connection or disconnection events; correlate with HCI command timing anomalies.

What your security team should do

• Apply kernel updates containing the fix on all systems exposing Bluetooth
• Disable Bluetooth radios where the feature is unnecessary
• Monitor kernel logs for oops/panic entries referencing rfcomm_check_security
• Test Bluetooth functionality after patching to ensure stability