CVE-2024-36011

What it actually does

Null pointer dereference in hci_le_big_sync_established_evt() during Bluetooth HCI event processing that can trigger kernel panic or memory corruption.

Why it matters to the business

Unexpected system crashes or instability on Linux devices using Bluetooth, leading to downtime and potential loss of connectivity-dependent services.

How an attack unfolds

An attacker crafts or triggers a Bluetooth Low Energy BIG sync established event that reaches the vulnerable handler with a null pointer, causing the dereference when the kernel processes the event.

How to fix it

Apply the kernel patch containing commit 2dde18cd1d8fac735875f2e4987f11817cc0bc2c or upgrade to a Linux kernel version that includes this fix.

How to confirm the fix worked

Verify the presence of commit 2dde18cd1d8fac735875f2e4987f11817cc0bc2c in the kernel source or confirm the kernel version contains the Bluetooth HCI null-pointer fix.

Typical attack path

1. Establish Bluetooth connection to target device
2. Send crafted LE BIG sync established event
3. Trigger null dereference in hci_le_big_sync_established_evt()
4. Cause kernel crash or instability

How to detect it

Review kernel logs for oops or panic messages referencing hci_le_big_sync_established_evt or Bluetooth HCI event processing; inspect dmesg output for null pointer dereference traces after Bluetooth activity.

What your security team should do

• Prioritize kernel updates containing the referenced commit for all Bluetooth-enabled systems
• Monitor kernel logs for Bluetooth-related oops or null pointer faults
• Disable Bluetooth when not required as a temporary mitigation