CVE-2024-42132

What it actually does

Missing upper-bound validation on connection handle values passed to hci_le_big_sync_established_evt allows handles exceeding HCI_CONN_HANDLE_MAX, causing hci_conn_del to treat the handle as unallocated and attempt to free it via the ida allocator.

Why it matters to the business

Linux systems using Bluetooth may experience kernel warnings or instability during LE audio or connection events, potentially affecting device reliability in embedded, server, or desktop environments.

How an attack unfolds

An attacker supplies a crafted hci_le_big_sync_established_evt event containing a handle larger than HCI_CONN_HANDLE_MAX; the kernel skips the ida allocation path, later invokes hci_conn_del on the oversized handle, and triggers a warning when attempting to release an untracked identifier.

How to fix it

Apply the upstream fix at commit ffc253263a1375a65fa6c9f62a893e9767fbebfa or upgrade to a Linux kernel containing this change; rebuild and deploy the patched kernel image on affected systems.

How to confirm the fix worked

Confirm the presence of the commit ffc253263a1375a65fa6c9f62a893e9767fbebfa in the kernel source tree or verify that hci_conn_set_handle-style bounds checks now exist before hci_le_big_sync_established_evt processing; re-run syzkaller-style fuzzing targeting the event handler.

Typical attack path

1. Send malicious Bluetooth LE BIG sync established event with oversized handle
2. Bypass handle validation in hci_conn_set_handle equivalent path
3. Trigger hci_conn_del on non-ida-allocated handle
4. Produce kernel warning or potential denial-of-service

How to detect it

Search kernel logs for warnings originating from hci_conn_del when an ida-allocated handle is expected; correlate with Bluetooth LE event processing and monitor for repeated ida free failures on connection teardown.

• hci_conn_del
• HCI_CONN_HANDLE_MAX
• hci_le_big_sync_established_evt
• ida_free

What your security team should do

• Prioritize kernel updates for all Bluetooth-enabled Linux deployments
• Add kernel warning monitoring for hci_conn_del and ida free operations
• Restrict untrusted Bluetooth LE traffic until patches are applied
• Review downstream distributions for backported fixes