CVE-2024-27416

What it actually does

The Linux kernel Bluetooth HCI event handler incorrectly processes HCI_EV_IO_CAPA_REQUEST events when a prior HCI_OP_READ_REMOTE_EXT_FEATURES command is still pending, causing the stack to assume SSP support without verification and enter an invalid pairing state.

Why it matters to the business

Linux-based systems may experience disrupted Bluetooth device pairing, unexpected connection drops, or degraded wireless functionality, impacting users and services that rely on Bluetooth peripherals.

How an attack unfolds

An attacker positioned to influence the Bluetooth HCI interface sends an IO capability request event while the remote extended features query remains unanswered, forcing the kernel into an erroneous SSP assumption that can be leveraged for further Bluetooth stack manipulation.

How to fix it

Apply the upstream fix present in commit d8a5b80568a9cb66810e75b182018e9edb68e8ff or upgrade to a kernel containing this change; rebuild and deploy updated kernel packages across affected systems.

How to confirm the fix worked

Verify the presence of commit d8a5b80568a9cb66810e75b182018e9edb68e8ff in the running kernel source tree or confirm the patched hci_event.c logic handles the pending feature query case.

Typical attack path

1. Establish a Bluetooth connection to trigger remote feature queries
2. Send crafted HCI_EV_IO_CAPA_REQUEST while HCI_OP_READ_REMOTE_EXT_FEATURES is pending
3. Trigger invalid state handling in the kernel Bluetooth stack

How to detect it

Review kernel logs for Bluetooth HCI event errors or unexpected SSP state transitions around pairing attempts; examine dmesg and syslog entries related to hci_event handling.

What your security team should do

• Prioritize kernel updates containing d8a5b80568a9cb66810e75b182018e9edb68e8ff on all Linux systems with Bluetooth enabled
• Temporarily disable Bluetooth where not required until patches are applied
• Monitor vendor kernel advisories for backported fixes in distribution releases