CVE-2024-36012

What it actually does

Use-after-free in Linux kernel Bluetooth msft handler: msft_unregister frees hdev->msft_data while a concurrent msft_do_close still holds and locks the now-freed structure, triggering slab-use-after-free on mutex operations.

Why it matters to the business

Linux systems with Bluetooth may experience kernel crashes or potential local privilege escalation, leading to downtime, data loss, or full host compromise on servers, desktops, and embedded devices.

How an attack unfolds

An attacker with local access triggers Bluetooth close paths while msft_unregister executes, racing the free of msft_data against its subsequent lock and use inside msft_do_close to achieve controlled memory corruption.

How to fix it

Upgrade the Linux kernel to commit e3880b531b68f98d3941d83f2f6dd11cf4fd6b76 or any later stable release that ties msft_data lifetime to hci_release_dev.

How to confirm the fix worked

Confirm the running kernel contains commit e3880b531b68f98d3941d83f2f6dd11cf4fd6b76; reproduce Bluetooth open/close cycles under KASAN and verify absence of use-after-free reports on msft structures.

Typical attack path

1. Obtain local execution on affected Linux host
2. Initiate Bluetooth device open/close sequences
3. Trigger msft_unregister concurrently with msft_do_close
4. Use freed msft_data pointer to corrupt kernel memory

How to detect it

Inspect kernel logs and KASAN reports for slab-use-after-free involving __mutex_lock_common and msft_do_close or msft_data references during Bluetooth shutdown paths.

What your security team should do

• Patch all Linux kernels to the fixed commit within maintenance windows
• Restrict untrusted local access until patches are deployed
• Monitor kernel logs for Bluetooth-related KASAN or slab errors