CVE-2024-56757

What it actually does

Failure to release a special USB interrupt interface used for ISO data transmission before unregistering the HCI device on USB disconnect triggers a use-after-free condition that results in kernel panic.

Why it matters to the business

Unexpected system crashes and loss of availability when MediaTek Bluetooth USB devices are disconnected, increasing operational disruption risk for affected Linux systems.

How an attack unfolds

An attacker with physical access removes a MediaTek Bluetooth USB dongle; the kernel does not release the claimed interface, leading to a use-after-free during HCI device unregistration and an immediate panic.

How to fix it

Apply the kernel fix that adds the interface release flow on USB disconnect; for listed chromium-browser packages on Ubuntu 14.04 LTS upgrade to version 52.0.2743.116-0ubuntu0.14.04.1.1134 or later.

How to confirm the fix worked

Confirm the updated kernel or chromium-browser package is installed and test USB disconnect/reconnect cycles with MediaTek Bluetooth hardware to verify no panic occurs.

Typical attack path

1. Identify a system using a MediaTek Bluetooth USB dongle
2. Trigger USB disconnect without prior interface release
3. Cause kernel panic during HCI unregistration

How to detect it

Review kernel logs for oops/panic entries mentioning btusb, mediatek, or hci_unregister_dev around the time of USB disconnect events.

What your security team should do

• Prioritize patching systems that use MediaTek Bluetooth USB devices due to the kernel panic risk
• Monitor for kernel oops or panic logs related to btusb and hci_unregister_dev
• Restrict physical access to USB ports on high-availability systems until patched