CVE-2024-58241

What it actually does

Use-after-free in the Linux kernel Bluetooth HCI core during hci_unregister_dev, caused by active works not being properly disabled before device cleanup.

Why it matters to the business

May cause kernel crashes or memory corruption on Linux systems using Bluetooth, resulting in denial of service and potential privilege escalation in high-complexity scenarios; low exploitation likelihood limits immediate operational risk.

How an attack unfolds

An attacker triggers repeated Bluetooth device registration and unregistration sequences to race the workqueue handling against device teardown, accessing freed memory structures in hci_core.

How to fix it

Apply the upstream kernel patch containing commit 0c3836482481200ead7b416ca80c68a29cfdaabd or upgrade to a distribution kernel that includes this fix; disable Bluetooth if the feature is unnecessary.

How to confirm the fix worked

Verify the running kernel source contains commit 0c3836482481200ead7b416ca80c68a29cfdaabd or confirm the patched hci_unregister_dev implementation disables pending works before freeing hci_dev.

Typical attack path

1. Obtain local or adjacent access to a Linux system with Bluetooth enabled
2. Register and unregister HCI devices repeatedly via userspace tools or crafted packets
3. Trigger the window where works remain scheduled after device unregistration
4. Perform memory manipulation to corrupt or reuse freed hci structures

How to detect it

Review kernel logs for Bluetooth HCI unregister events followed by use-after-free warnings or oops; inspect workqueue activity around hci_dev teardown in crash dumps.

What your security team should do

• Patch affected Linux kernels to the fixed commit within normal maintenance windows given low EPSS
• Monitor for future EPSS increases or KEV inclusion
• Restrict unprivileged Bluetooth access via system policies where feasible