CVE-2024-35966

What it actually does

Insufficient length validation in rfcomm_sock_setsockopt_old allows copy_from_sockptr to perform an out-of-bounds slab read of attacker-supplied data via Bluetooth RFCOMM sockets.

Why it matters to the business

Linux systems using Bluetooth may experience kernel memory disclosure or crashes, increasing risk of data exposure and unplanned downtime on servers, desktops, and embedded devices.

How an attack unfolds

A local attacker opens an RFCOMM socket and invokes setsockopt with a crafted option and length that exceeds the actual user buffer; the kernel copies the data without bounds checking, triggering the slab-out-of-bounds read reported by KASAN.

How to fix it

Upgrade the Linux kernel to commit d072ea24748189cd8f4a9c3f585ca9af073a0838 or later stable releases that contain the fix for CVE-2024-35966.

How to confirm the fix worked

Verify the running kernel contains commit d072ea24748189cd8f4a9c3f585ca9af073a0838; recompile with KASAN and confirm the syzbot reproducer no longer triggers slab-out-of-bounds reports.

Typical attack path

1. Obtain local user or process execution on a Linux host with Bluetooth RFCOMM support enabled
2. Create an AF_BLUETOOTH SOCK_STREAM socket and bind it to an RFCOMM channel
3. Call setsockopt with SOL_RFCOMM and an option that triggers rfcomm_sock_setsockopt_old using an undersized or oversized user buffer
4. Observe resulting OOB read for information disclosure or kernel instability

How to detect it

Review kernel audit logs and Bluetooth stack traces for unusual setsockopt calls on RFCOMM sockets; correlate with KASAN reports or oops messages referencing rfcomm_sock_setsockopt.

What your security team should do

• Apply the referenced kernel commit or distribution backport within patch windows
• Disable Bluetooth RFCOMM if the feature is unused on the system
• Monitor EPSS and threat-intel feeds for any increase in exploitation activity
• Include the fixed commit hash in SBOM and kernel update automation