CVE-2024-56591

What it actually does

Race condition in hci_conn cleanup where cancel_delayed_work_sync permits new delayed work submissions after the connection object begins freeing, allowing use-after-free in Bluetooth stack.

Why it matters to the business

Linux systems using Bluetooth may experience kernel instability or crashes; low exploitation likelihood limits widespread operational disruption but still requires timely kernel updates on affected distributions.

How an attack unfolds

An attacker with local access or ability to trigger Bluetooth connection events races work item submission against object teardown to corrupt kernel memory during hci_conn free; no named threat actors or ransomware campaigns are associated.

How to fix it

Update Linux kernel to commit c55a4c5a04bae40dcdc1e1c19d8eb79a06fb3397 or later stable releases; apply distribution-specific fixes such as libxslt 1.1.28-2ubuntu0.1 on Ubuntu 14.04 LTS and 1.1.28-2.1ubuntu0.1 on Ubuntu 16.04 LTS where applicable.

How to confirm the fix worked

Verify kernel version or commit contains the disable_delayed_work_sync change; confirm no Bluetooth hci_conn objects are freed while delayed work remains schedulable.

Typical attack path

1. Trigger Bluetooth connection or disconnection events to allocate hci_conn object
2. Race delayed work submission against the object's teardown path
3. Cause use-after-free when freed object is accessed by pending work
4. Attempt to leverage resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs and Bluetooth stack traces for hci_conn related work item warnings or crashes around object teardown; no widespread in-the-wild exploitation observed.

What your security team should do

• Prioritize kernel updates on systems with Bluetooth enabled within standard patch windows given low EPSS
• Monitor for future EPSS increases or KEV addition
• Disable Bluetooth where not required as a temporary control