CVE-2024-56654

What it actually does

Incorrect RCU read-side locking around list_for_each_entry_rcu in Bluetooth HCI event handling allows rcu_dereference results to be used outside the critical section, enabling potential use-after-free or invalid memory accesses during list iteration.

Why it matters to the business

Linux-based systems with Bluetooth enabled risk kernel instability, crashes, or memory corruption that can disrupt device operation and require unplanned reboots or patches across fleets of servers, desktops, and embedded devices.

How an attack unfolds

An attacker triggers Bluetooth HCI events that cause concurrent list modifications while the flawed iteration code runs; the missing RCU protection lets a pointer become invalid after the read-side section ends, leading to out-of-bounds or freed-memory dereferences. No named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade the Linux kernel to a version containing commit 2dde18cd1d8fac735875f2e4987f11817cc0bc2c or later; rebuild and reboot affected systems. Where immediate patching is not possible, disable Bluetooth interfaces via kernel configuration or runtime controls.

How to confirm the fix worked

Verify the presence of commit 2dde18cd1d8fac735875f2e4987f11817cc0bc2c in the kernel source tree or confirm the running kernel version includes the corrected hci_event.c logic; recompile with CONFIG_LOCKDEP and run RCU-related stress tests on Bluetooth paths.

Typical attack path

1. Establish a Bluetooth connection or send HCI commands to the target kernel
2. Induce list modifications (device add/remove) concurrent with event processing
3. Trigger the unsafe list_for_each_entry_rcu path in hci_event handling
4. Cause dereference of an RCU pointer outside its read-side critical section

How to detect it

Review kernel logs for Bluetooth-related oops or warnings mentioning hci_event or RCU; examine auditd and dmesg output around device attach/detach events for unexpected crashes. No specific threat-actor campaigns are known.

What your security team should do

• Apply the referenced kernel commit or distribution update within normal patch windows given low EPSS and absence from KEV
• Audit custom kernels and embedded Linux images for the vulnerable hci_event iteration pattern
• Monitor upstream stable and LTS branches for backports of the fix