CVE-2024-56590

What it actually does

Missing length validation on skb before accessing ACL header in hci_acldata_packet allows out-of-bounds memory read from uninitialized or invalid data past skb->data.

Why it matters to the business

Kernel memory corruption on Bluetooth-enabled Linux systems can cause crashes, information leaks, or potential privilege escalation, disrupting device connectivity and requiring urgent patching across fleets.

How an attack unfolds

An attacker sends a crafted Bluetooth ACL data packet with insufficient skb length; the kernel code proceeds to dereference past the valid buffer without checks, reading invalid memory and potentially triggering corruption or crashes in the Bluetooth stack.

How to fix it

Update to fixed kernel versions containing commit 219960a48771b35a3857a491b955c31d6c33d581 or apply distribution packages such as undertow 1.4.23-3 on Ubuntu 18.04 LTS or 2.3.8-2 on Ubuntu 24.10.

How to confirm the fix worked

Confirm kernel source contains the skb length check in hci_acldata_packet and test with crafted short ACL packets to ensure no out-of-bounds access occurs.

Typical attack path

1. Establish Bluetooth connection or inject packets via local radio
2. Transmit malformed ACL data packet lacking full header
3. Trigger hci_acldata_packet handler without length verification
4. Access uninitialized memory leading to corruption or information disclosure

How to detect it

Review kernel logs for Bluetooth HCI ACL packet processing errors or oops messages; inspect network traces for anomalous short ACL packets.

What your security team should do

• Apply the referenced kernel commit or package updates immediately on all Bluetooth-enabled systems
• Disable Bluetooth where not required until patched
• Monitor for related memory corruption indicators in kernel logs