CVE-2024-35978

What it actually does

Memory leak in hci_req_sync_complete() where prior sync request state is not freed before new reference assignment, causing gradual kernel memory consumption in Bluetooth request handling.

Why it matters to the business

Long-running Linux systems with Bluetooth enabled may experience memory exhaustion leading to instability or denial of service; low immediate risk given absence from known exploited vulnerabilities lists and stable low exploit probability.

How an attack unfolds

An attacker with local access repeatedly triggers Bluetooth synchronization operations that invoke hci_req_sync_complete() without proper cleanup, accumulating unreleased memory allocations until system resources are depleted.

How to fix it

Update Linux kernel to a version containing commit 89a32741f4217856066c198a4a7267bcdd1edd67 or later stable release that resolves the memory leak in hci_req_sync_complete().

How to confirm the fix worked

Verify kernel source contains the referenced commit hash; test by exercising Bluetooth request paths and confirming no progressive memory growth in kernel memory statistics.

Typical attack path

1. Obtain local user access on affected Linux kernel system
2. Repeatedly initiate Bluetooth pairing or request synchronization operations
3. Trigger hci_req_sync_complete() path multiple times to accumulate leaked memory
4. Monitor for system degradation due to memory pressure

How to detect it

Review kernel logs and memory usage statistics for unexpected growth correlated with Bluetooth activity; examine dmesg or /proc/meminfo for patterns after extended Bluetooth operations.

What your security team should do

• Apply the referenced kernel commit or updated distribution packages immediately on Bluetooth-enabled systems
• Monitor kernel memory usage on systems running Bluetooth stacks
• Disable Bluetooth where not required to reduce exposure surface