CVE-2024-42133

What it actually does

The Bluetooth stack fails to validate handle values in hci_le_big_sync_established_evt against the IDA ID range, allowing invalid handles to reach hci_conn_cleanup and trigger erroneous IDA release.

Why it matters to the business

Linux systems using Bluetooth may experience crashes or instability in wireless audio and device connectivity, increasing downtime for affected devices and requiring kernel updates across fleets.

How an attack unfolds

An attacker sends a crafted Bluetooth Low Energy BIG synchronization established event containing an out-of-range handle value; the missing validation allows the handle to be treated as valid, causing improper resource release during connection cleanup that can lead to kernel instability.

How to fix it

Upgrade the Linux kernel to a version containing commit ffc253263a1375a65fa6c9f62a893e9767fbebfa or later; rebuild and deploy the updated kernel image on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit ffc253263a1375a65fa6c9f62a893e9767fbebfa by checking /proc/version or git describe output; test Bluetooth BIG synchronization events to ensure oversized handles are now ignored.

Typical attack path

1. Establish a Bluetooth connection to a vulnerable Linux host
2. Transmit a malicious hci_le_big_sync_established_evt packet with an oversized handle
3. Trigger hci_conn_cleanup path that erroneously releases the IDA ID
4. Observe resulting kernel panic or Bluetooth subsystem failure

How to detect it

Review kernel logs for hci_conn_cleanup or hci_le_big_sync_established_evt entries mentioning invalid or oversized handle values; correlate with Bluetooth subsystem crashes or panics.

• hci_le_big_sync_established_evt
• hci_conn_cleanup
• BIG handle value out of range

What your security team should do

• Apply the kernel patch containing ffc253263a1375a65fa6c9f62a893e9767fbebfa immediately on all Bluetooth-enabled Linux hosts
• Prioritize updates for systems handling wireless audio or peripheral devices
• Monitor vendor kernel update channels for backported fixes in distribution releases