CVE-2024-42137

What it actually does

Use-after-free in the qca Bluetooth driver (hci_qca) within qca_serdev_shutdown when the serdev is closed before flush/write operations, allowing potential kernel memory corruption on QCA6390 hardware during warm reboot sequences if enable-gpios is absent from DT/ACPI.

Why it matters to the business

Kernel instability, crashes, or local privilege escalation risk on Linux systems and devices using affected Qualcomm Atheros Bluetooth controllers, disrupting connectivity after restarts and requiring urgent patching across fleets with high downstream kernel dependency counts.

How an attack unfolds

An attacker with local access triggers Bluetooth enable/disable cycles followed by a warm reboot to reach the flawed shutdown path; the use-after-free can then be leveraged to corrupt kernel structures, potentially leading to code execution, though no widespread campaigns by named actors have been observed.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.10.222 or apply commit 215a26c2404fa34625c725d446967fa328a703eb in the bluetooth-next or mainline trees; rebuild and deploy the updated kernel image across all affected systems.

How to confirm the fix worked

Confirm kernel version meets or exceeds the fixed releases, test Bluetooth enablement after cold boot, disable, warm reboot sequences on QCA6390 hardware, and verify absence of related oops or use-after-free warnings in dmesg.

Typical attack path

1. Obtain local user access on affected Linux system
2. Enable and disable Bluetooth via user-space tools or APIs
3. Perform warm reboot without full power cycle
4. Trigger qca_serdev_shutdown to hit use-after-free condition
5. Exploit resulting memory corruption for privilege escalation

How to detect it

Inspect kernel logs for qca_serdev_shutdown errors, Bluetooth enable failures after warm reboots, or use-after-free warnings in dmesg; correlate with process activity involving btusb or hci_qca modules.

What your security team should do

• Immediately schedule kernel updates to the listed fixed versions prioritizing internet-facing or multi-user systems
• Review and test Bluetooth functionality post-update on representative hardware
• Monitor EPSS and KEV status for any change indicating increased exploit activity