CVE-2024-42141

What it actually does

Null pointer dereference in net/bluetooth/iso.c:iso_sock_recvmsg when pi->conn->hcon is NULL after clearing BT_SK_DEFER_SETUP on a BT_CONNECT2 socket, leading to iso_conn_defer_accept(NULL) and subsequent memory corruption.

Why it matters to the business

Kernel instability or crashes on Bluetooth ISO-enabled Linux systems, potentially disrupting wireless audio, headsets, or low-latency data links and requiring reboots or causing data loss.

How an attack unfolds

An attacker establishes a Bluetooth ISO connection, manipulates socket state to BT_CONNECT2 with BT_SK_DEFER_SETUP set, then triggers recvmsg such that hcon is NULL, causing the kernel to dereference the null pointer during defer-accept handling.

How to fix it

Upgrade the Linux kernel to the commit ffc253263a1375a65fa6c9f62a893e9767fbebfa or later; apply the fix in net/bluetooth/iso.c that checks the socket flag instead of dereferencing hcon.

How to confirm the fix worked

Verify the running kernel contains commit ffc253263a1375a65fa6c9f62a893e9767fbebfa; inspect iso_sock_recvmsg for the added BT_SK_DEFER_SETUP test before any hcon access; confirm no Smatch warning on the function.

Typical attack path

1. Establish Bluetooth ISO socket connection
2. Force socket into BT_CONNECT2 state with BT_SK_DEFER_SETUP flag
3. Send recvmsg while hcon remains NULL
4. Trigger null dereference in iso_conn_defer_accept

How to detect it

Search kernel logs for oops/panic traces containing iso_sock_recvmsg, iso_conn_defer_accept, or BT_SK_DEFER_SETUP; examine Bluetooth stack traces for NULL hcon dereferences on ISO sockets.

What your security team should do

• Apply the kernel patch containing ffc253263a1375a65fa6c9f62a893e9767fbebfa immediately on all Bluetooth-enabled systems
• Monitor for kernel oops or panics referencing iso_sock_recvmsg or iso_conn_defer_accept
• Disable Bluetooth ISO sockets via kernel config if patching is delayed