CVE-2024-41062

What it actually does

Race condition between socket close path and hci_rx_work allows use-after-free access to a released L2CAP socket pointer in l2cap_sock_recv_cb when chan data is not yet nulled.

Why it matters to the business

Linux systems using Bluetooth can experience kernel crashes, memory corruption, or potential local privilege escalation, increasing downtime and security risk especially on servers or embedded devices with high Bluetooth usage.

How an attack unfolds

An attacker with local access triggers concurrent socket close and incoming L2CAP data processing; the receive callback runs after sk_free but before synchronization, dereferencing an invalid pointer. No public in-the-wild exploitation is known despite mentions of broad 2024 campaigns targeting Linux kernel flaws.

How to fix it

Upgrade the Linux kernel to the commit 605572e64cd9cebb05ed609d96cff05b50d18cdf or later stable releases that include the chan mutex and NULLing of chan data in the receive path.

How to confirm the fix worked

Verify the running kernel contains commit 605572e64cd9cebb05ed609d96cff05b50d18cdf; test by exercising L2CAP close/receive concurrency under load and confirm absence of use-after-free warnings in kernel logs.

Typical attack path

1. Obtain local code execution on a Linux host with Bluetooth enabled
2. Open an L2CAP socket and begin data exchange
3. Race sock_close/l2cap_sock_release against hci_rx_work/l2cap_recv_frame
4. Trigger use-after-free in l2cap_sock_recv_cb to corrupt kernel memory or crash
5. Escalate via corrupted structures if exploitation succeeds

How to detect it

Review kernel logs for use-after-free or NULL pointer dereference traces involving l2cap_sock_recv_cb, l2cap_conless_channel, or hci_rx_work around socket close events; correlate with Bluetooth activity spikes.

What your security team should do

• Apply the referenced kernel commit or newer distribution packages immediately on all Bluetooth-enabled systems
• Disable Bluetooth kernel modules where not required to reduce attack surface
• Monitor for future EPSS increases or KEV inclusion given ongoing Linux kernel targeting by espionage and financially motivated actors
• Include the fix in standard kernel update and reboot cycles within 30 days