CVE-2024-49951

What it actually does

Race condition in Bluetooth MGMT handling allows mgmt_index_removed to be invoked while commands remain queued on cmd_sync, leading to invalid list deletion and kernel crash during hci_cmd_sync_work processing.

Why it matters to the business

Bluetooth-enabled Linux systems can experience sudden crashes and service disruption when index removal occurs concurrently with pending management commands, increasing operational downtime risk in affected environments.

How an attack unfolds

An attacker with local or adjacent access triggers Bluetooth management events that queue commands on cmd_sync and then forces mgmt_index_removed, causing the kernel to dereference invalid list entries and panic as shown in the provided trace.

How to fix it

Apply the upstream fix from commit 19b40ca62607cef78369549d1af091f2fd558931 in the Linux kernel stable tree; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 19b40ca62607cef78369549d1af091f2fd558931 or later equivalent; test Bluetooth index removal under load with queued mgmt commands to verify absence of crash.

Typical attack path

1. Establish Bluetooth connection or management context to queue commands via cmd_sync
2. Trigger mgmt_index_removed while commands remain pending
3. Induce hci_cmd_sync_work to process the stale user_data references
4. Cause __list_del_entry_valid_or_report failure and kernel panic

How to detect it

Review kernel logs for Bluetooth MGMT traces involving mgmt_pending_remove, mgmt_remove_adv_monitor_complete, or __list_del_entry_valid_or_report failures coinciding with hci_cmd_sync_work; correlate with Bluetooth device attach/detach events.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all Bluetooth-enabled Linux hosts within standard patch windows
• Monitor for kernel oops or Bluetooth-related panics in system logs as a temporary detection measure
• Disable Bluetooth where not required to reduce attack surface until patched