CVE-2024-50124

What it actually does

Use-after-free in the Bluetooth ISO socket timeout handler where conn->sk may be unlinked or freed while waiting on iso_conn_lock, allowing invalid memory access after the check for membership in iso_sk_list.

Why it matters to the business

Affected Linux systems using Bluetooth ISO may suffer kernel instability, crashes, or potential code execution, leading to downtime, data loss, or compromise of systems with Bluetooth enabled.

How an attack unfolds

An attacker establishes an ISO Bluetooth connection and forces a timeout race condition that frees the socket while the timeout handler holds a reference, then uses the dangling pointer for memory corruption or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit 876ac72d535fa94f4ac57bba651987c6f990f646 or later; apply vendor kernel updates for all affected distributions.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or later, review Bluetooth ISO socket handling code for the added validity check, and test timeout scenarios under load.

Typical attack path

1. Create and configure an ISO Bluetooth socket
2. Trigger concurrent socket unlink or free operation
3. Allow iso_sock_timeout to execute after the socket is freed
4. Abuse the invalid reference for memory corruption or crash

How to detect it

Search kernel logs and dmesg for Bluetooth ISO timeout oops messages, use-after-free warnings, or crashes involving iso_sock or iso_conn_lock; correlate with Bluetooth connection activity in audit logs.

What your security team should do

• Apply the kernel fix as the highest priority on all systems with Bluetooth support
• Disable Bluetooth ISO or Bluetooth entirely where not required
• Monitor kernel logs for Bluetooth-related oops or panic entries
• Review and restrict Bluetooth usage policies in high-risk environments