CVE-2024-58238

What it actually does

Race condition in the btnxpuart Bluetooth driver allows concurrent UART break toggling and ps_state read/write operations, causing psdata->work to be skipped when ps_state is incorrectly read as PS_STATE_AWAKE, resulting in permanent TX command timeouts.

Why it matters to the business

Bluetooth adapters on affected Linux systems can lose command responsiveness during power-save cycles, leading to failed device pairing, advertising failures, and unreliable wireless connectivity in embedded or IoT deployments.

How an attack unfolds

An attacker with local access or ability to trigger repeated HCI commands (such as LE advertising) while the power-save feature is enabled can time operations to coincide with the 2-second UART break interval, forcing the race that leaves the transmitter stuck and commands timing out.

How to fix it

Upgrade the Linux kernel package to version 6.1.147-1 or later on Debian 12 systems; the fix adds a ps_lock mutex protecting UART break state changes and ps_state accesses, and adjusts btnxpuart_tx_wakeup to reschedule correctly after wake-up.

How to confirm the fix worked

Confirm the running kernel is at least 6.1.147-1, then execute the provided stress-test script for several thousand iterations while monitoring for absence of 'command tx timeout' messages in dmesg.

Typical attack path

1. Enable power-save mode via vendor HCI command on btnxpuart interface
2. Repeatedly issue LE advertising start/stop commands at intervals matching the power-save timeout
3. Trigger simultaneous btnxpuart_tx_wakeup and UART break handling to win the race on ps_state
4. Observe command timeout and driver stuck in PS_STATE_SLEEP state

How to detect it

Search kernel logs and dmesg for repeated 'command .* tx timeout' entries combined with btnxpuart_queue_skb and Set UART break messages; inspect for the exact sequence of HCI commands coinciding with 2-second sleep intervals.

• Bluetooth: hci0: command 0x200a tx timeout
• Bluetooth: btnxpuart_queue_skb(): 01 0A 20 01 00
• Bluetooth: hci0: Set UART break: on, status=0
• Can't set advertise mode on hci0: Connection timed out (110)

What your security team should do

• Prioritize kernel package updates on all systems using btnxpuart Bluetooth hardware
• Disable power-save mode via hcitool if immediate patching is not possible
• Monitor kernel logs for repeated 'tx timeout' entries on hci interfaces
• Validate Bluetooth functionality after reboot on patched systems