CVE-2024-35964

What it actually does

The Bluetooth ISO socket implementation failed to validate the length of user-supplied data before performing a copy operation via setsockopt, allowing malformed or oversized input to reach kernel memory handling routines.

Why it matters to the business

Unpatched Linux kernels remain exposed to local attacks that can crash systems or potentially escalate privileges on Bluetooth-enabled devices, increasing operational risk for servers, desktops, and embedded systems that rely on the kernel.

How an attack unfolds

An attacker with local access invokes setsockopt on an ISO Bluetooth socket with a crafted option structure whose length field is not checked, causing the kernel to copy attacker-controlled data beyond intended boundaries.

How to fix it

Upgrade the Linux kernel to a version containing commit cec736e60dc18d91b88af28d96664bff284b02d1 or later stable releases that include the input-length validation fix for Bluetooth ISO setsockopt.

How to confirm the fix worked

Verify the running kernel contains commit cec736e60dc18d91b88af28d96664bff284b02d1 or a backported equivalent; confirm setsockopt length checks are present in net/bluetooth/iso.c or review kernel changelog for the fix.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Create or open an ISO Bluetooth socket
3. Prepare a setsockopt call with an invalid or oversized option length
4. Trigger the copy operation to reach the unvalidated code path
5. Achieve kernel crash, memory corruption, or privilege escalation

How to detect it

Review kernel audit logs and system call traces for unusual setsockopt calls on Bluetooth ISO sockets; look for crashes or oops messages referencing iso_sock_setsockopt or related Bluetooth functions shortly after socket operations.

What your security team should do

• Apply the kernel update containing the referenced commit as soon as possible
• Restrict untrusted local users from accessing Bluetooth functionality until patched
• Monitor for new kernel releases and schedule regression testing of Bluetooth ISO workloads