CVE-2024-57894

What it actually does

The vulnerability allows a mutex acquisition (sleeping operation) to be invoked from an invalid context such as a workqueue bottom-half with RCU read lock held, specifically in hci_le_create_big_complete_evt while processing hci_rx_work on the Bluetooth HCI event path.

Why it matters to the business

Systems running affected Linux kernels may experience kernel panics or instability when Bluetooth LE events are processed, disrupting wireless connectivity and potentially causing downtime on servers, embedded devices, or desktops that rely on the Bluetooth stack.

How an attack unfolds

An attacker with local or adjacent access triggers Bluetooth LE Create BIG complete events that race with hci_rx_work processing; the resulting call to hci_connect_cfm attempts mutex acquisition while RCU and workqueue locks are held, hitting the sleeping-function-from-invalid-context BUG and potentially leading to denial of service.

How to fix it

Upgrade the Linux kernel package to version 6.1.124-1 or newer on Debian 12 systems; rebuild and reboot with the patched kernel; disable Bluetooth if the feature is not required until the update can be applied.

How to confirm the fix worked

Verify the running kernel version is at least 6.1.124-1; confirm absence of the 'sleeping function called from invalid context' BUG in dmesg after exercising Bluetooth LE event paths; run regression tests that exercise hci_rx_work and hci_le_create_big_complete_evt.

Typical attack path

1. Gain ability to send crafted Bluetooth HCI events to the target interface
2. Trigger hci_le_create_big_complete_evt while the rx_work queue holds device lock and RCU read lock
3. Force execution of hci_connect_cfm which calls mutex_lock on hci_cb_list_lock from atomic context
4. Kernel hits BUG in mutex.c and panics or corrupts state

How to detect it

Search kernel logs and dmesg for 'sleeping function called from invalid context' combined with 'hci_le_create_big_complete_evt' and 'hci_rx_work'; inspect workqueue traces containing hci0 and kworker threads; correlate with Bluetooth event packets arriving shortly before the crash.

• BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585
• hci_le_create_big_complete_evt+0x3d9/0xae0
• hci_rx_work+0x3e8/0xca0
• kworker/u9.*hci0
• ffff8880665d0078 (&hdev->lock)

What your security team should do

• Apply the 6.1.124-1 kernel update on all Debian 12 systems within the next maintenance window
• Monitor kernel logs for the mutex BUG signature until patching is complete
• Disable Bluetooth HCI interfaces via rfkill or kernel config where wireless is unnecessary
• Review downstream dependent packages that ship custom Bluetooth drivers for similar locking issues