CVE-2024-50029

What it actually does

Use-after-free in hci_enhanced_setup_sync when an ACL connection object is freed while a cmd_sync work item is still pending on the hci_cmd_sync_work queue, allowing subsequent access to the freed slab memory.

Why it matters to the business

Potential kernel memory corruption on Bluetooth-enabled Linux systems can lead to crashes, denial of service, or local privilege escalation; the large number of downstream kernel dependents increases exposure across servers, embedded devices, and desktops until patched.

How an attack unfolds

An attacker triggers a SCO socket connect that schedules hci_enhanced_setup_sync; concurrent connection abort or deletion frees the hci_conn while the work item is queued; when the worker runs it dereferences the freed object, enabling memory corruption.

How to fix it

Upgrade the Linux kernel to a version containing commit 867639300759e3e1c5b1e1a5ff89231f263a32a7; apply the fixed package versions such as firefox 0:91.4.0-1.el8_5 where applicable and rebuild any custom kernels with the patch.

How to confirm the fix worked

Confirm the presence of the fix commit in the kernel tree, boot the updated kernel, and exercise Bluetooth SCO connection and abort paths under memory debugging tools such as KASAN to ensure no use-after-free reports occur.

Typical attack path

1. Establish or initiate a Bluetooth SCO connection via sco_sock_connect
2. Force or race an hci_conn_del / hci_abort_conn_sync to free the ACL object
3. Allow the pending hci_cmd_sync_work to execute hci_enhanced_setup_sync on the freed structure
4. Leverage the resulting slab-use-after-free for corruption or information leak

How to detect it

Search kernel logs and dmesg for KASAN slab-use-after-free reports mentioning hci_enhanced_setup_sync, hci_cmd_sync_work, or hci_conn_del; correlate with Bluetooth connection attempts in audit logs or /var/log/messages around the time of any kernel oops.

What your security team should do

• Prioritize kernel updates on all Bluetooth-enabled systems within the CISA-style remediation window
• Disable Bluetooth kernel modules (bluetooth, hci_uart, etc.) on systems that do not require it
• Add kernel crash and KASAN logging to SIEM for hci_conn related oops
• Review downstream dependent packages and rebuild images with the fixed commit