GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-26890 (GCVE-0-2024-26890)

Vulnerability from cvelistv5 – Published: 2024-04-17 10:27 – Updated: 2026-08-05 11:28
VLAI
Title
Bluetooth: btrtl: fix out of bounds memory access
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: fix out of bounds memory access The problem is detected by KASAN. btrtl driver uses private hci data to store 'struct btrealtek_data'. If btrtl driver is used with btusb, then memory for private hci data is allocated in btusb. But no private data is allocated after hci_dev, when btrtl is used with hci_h5. This commit adds memory allocation for hci_h5 case. ================================================================== BUG: KASAN: slab-out-of-bounds in btrtl_initialize+0x6cc/0x958 [btrtl] Write of size 8 at addr ffff00000f5a5748 by task kworker/u9:0/76 Hardware name: Pine64 PinePhone (1.2) (DT) Workqueue: hci0 hci_power_on [bluetooth] Call trace: dump_backtrace+0x9c/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5d8 kasan_report+0x90/0xd0 __asan_store8+0x9c/0xc0 [btrtl] h5_btrtl_setup+0xd0/0x2f8 [hci_uart] h5_setup+0x50/0x80 [hci_uart] hci_uart_setup+0xd4/0x260 [hci_uart] hci_dev_open_sync+0x1cc/0xf68 [bluetooth] hci_dev_do_open+0x34/0x90 [bluetooth] hci_power_on+0xc4/0x3c8 [bluetooth] process_one_work+0x328/0x6f0 worker_thread+0x410/0x778 kthread+0x168/0x178 ret_from_fork+0x10/0x20 Allocated by task 53: kasan_save_stack+0x3c/0x68 kasan_save_track+0x20/0x40 kasan_save_alloc_info+0x68/0x78 __kasan_kmalloc+0xd4/0xd8 __kmalloc+0x1b4/0x3b0 hci_alloc_dev_priv+0x28/0xa58 [bluetooth] hci_uart_register_device+0x118/0x4f8 [hci_uart] h5_serdev_probe+0xf4/0x178 [hci_uart] serdev_drv_probe+0x54/0xa0 really_probe+0x254/0x588 __driver_probe_device+0xc4/0x210 driver_probe_device+0x64/0x160 __driver_attach_async_helper+0x88/0x158 async_run_entry_fn+0xd0/0x388 process_one_work+0x328/0x6f0 worker_thread+0x410/0x778 kthread+0x168/0x178 ret_from_fork+0x10/0x20 Last potentially related work creation: kasan_save_stack+0x3c/0x68 __kasan_record_aux_stack+0xb0/0x150 kasan_record_aux_stack_noalloc+0x14/0x20 __queue_work+0x33c/0x960 queue_work_on+0x98/0xc0 hci_recv_frame+0xc8/0x1e8 [bluetooth] h5_complete_rx_pkt+0x2c8/0x800 [hci_uart] h5_rx_payload+0x98/0xb8 [hci_uart] h5_recv+0x158/0x3d8 [hci_uart] hci_uart_receive_buf+0xa0/0xe8 [hci_uart] ttyport_receive_buf+0xac/0x178 flush_to_ldisc+0x130/0x2c8 process_one_work+0x328/0x6f0 worker_thread+0x410/0x778 kthread+0x168/0x178 ret_from_fork+0x10/0x20 Second to last potentially related work creation: kasan_save_stack+0x3c/0x68 __kasan_record_aux_stack+0xb0/0x150 kasan_record_aux_stack_noalloc+0x14/0x20 __queue_work+0x788/0x960 queue_work_on+0x98/0xc0 __hci_cmd_sync_sk+0x23c/0x7a0 [bluetooth] __hci_cmd_sync+0x24/0x38 [bluetooth] btrtl_initialize+0x760/0x958 [btrtl] h5_btrtl_setup+0xd0/0x2f8 [hci_uart] h5_setup+0x50/0x80 [hci_uart] hci_uart_setup+0xd4/0x260 [hci_uart] hci_dev_open_sync+0x1cc/0xf68 [bluetooth] hci_dev_do_open+0x34/0x90 [bluetooth] hci_power_on+0xc4/0x3c8 [bluetooth] process_one_work+0x328/0x6f0 worker_thread+0x410/0x778 kthread+0x168/0x178 ret_from_fork+0x10/0x20 ==================================================================
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-16 15:26 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5b355944b19011011dd3fd4187444c5ff1d76ad2 , < dd163fa34c483f1674aa2510accce11a224f649e (git)
Affected: 5b355944b19011011dd3fd4187444c5ff1d76ad2 , < 2f232bc389a4f5943c40733582f9edf77b89e499 (git)
Affected: 5b355944b19011011dd3fd4187444c5ff1d76ad2 , < 0c657e641df1e77d6087688190f632cad9c0439b (git)
Affected: 5b355944b19011011dd3fd4187444c5ff1d76ad2 , < de4e88ec58c4202efd1f02eebb4939bbf6945358 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.23 , ≤ 6.6.* (semver)
Unaffected: 6.7.11 , ≤ 6.7.* (semver)
Unaffected: 6.8.2 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26890",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-16T15:26:42.807885Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T15:19:10.562Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.409Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dd163fa34c483f1674aa2510accce11a224f649e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2f232bc389a4f5943c40733582f9edf77b89e499"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0c657e641df1e77d6087688190f632cad9c0439b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/de4e88ec58c4202efd1f02eebb4939bbf6945358"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/hci_h5.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dd163fa34c483f1674aa2510accce11a224f649e",
              "status": "affected",
              "version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
              "versionType": "git"
            },
            {
              "lessThan": "2f232bc389a4f5943c40733582f9edf77b89e499",
              "status": "affected",
              "version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
              "versionType": "git"
            },
            {
              "lessThan": "0c657e641df1e77d6087688190f632cad9c0439b",
              "status": "affected",
              "version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
              "versionType": "git"
            },
            {
              "lessThan": "de4e88ec58c4202efd1f02eebb4939bbf6945358",
              "status": "affected",
              "version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/hci_h5.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: fix out of bounds memory access\n\nThe problem is detected by KASAN.\nbtrtl driver uses private hci data to store \u0027struct btrealtek_data\u0027.\nIf btrtl driver is used with btusb, then memory for private hci data\nis allocated in btusb. But no private data is allocated after hci_dev,\nwhen btrtl is used with hci_h5.\n\nThis commit adds memory allocation for hci_h5 case.\n\n ==================================================================\n BUG: KASAN: slab-out-of-bounds in btrtl_initialize+0x6cc/0x958 [btrtl]\n Write of size 8 at addr ffff00000f5a5748 by task kworker/u9:0/76\n\n Hardware name: Pine64 PinePhone (1.2) (DT)\n Workqueue: hci0 hci_power_on [bluetooth]\n Call trace:\n  dump_backtrace+0x9c/0x128\n  show_stack+0x20/0x38\n  dump_stack_lvl+0x48/0x60\n  print_report+0xf8/0x5d8\n  kasan_report+0x90/0xd0\n  __asan_store8+0x9c/0xc0\n  \t [btrtl]\n  h5_btrtl_setup+0xd0/0x2f8 [hci_uart]\n  h5_setup+0x50/0x80 [hci_uart]\n  hci_uart_setup+0xd4/0x260 [hci_uart]\n  hci_dev_open_sync+0x1cc/0xf68 [bluetooth]\n  hci_dev_do_open+0x34/0x90 [bluetooth]\n  hci_power_on+0xc4/0x3c8 [bluetooth]\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n\n Allocated by task 53:\n  kasan_save_stack+0x3c/0x68\n  kasan_save_track+0x20/0x40\n  kasan_save_alloc_info+0x68/0x78\n  __kasan_kmalloc+0xd4/0xd8\n  __kmalloc+0x1b4/0x3b0\n  hci_alloc_dev_priv+0x28/0xa58 [bluetooth]\n  hci_uart_register_device+0x118/0x4f8 [hci_uart]\n  h5_serdev_probe+0xf4/0x178 [hci_uart]\n  serdev_drv_probe+0x54/0xa0\n  really_probe+0x254/0x588\n  __driver_probe_device+0xc4/0x210\n  driver_probe_device+0x64/0x160\n  __driver_attach_async_helper+0x88/0x158\n  async_run_entry_fn+0xd0/0x388\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n\n Last potentially related work creation:\n  kasan_save_stack+0x3c/0x68\n  __kasan_record_aux_stack+0xb0/0x150\n  kasan_record_aux_stack_noalloc+0x14/0x20\n  __queue_work+0x33c/0x960\n  queue_work_on+0x98/0xc0\n  hci_recv_frame+0xc8/0x1e8 [bluetooth]\n  h5_complete_rx_pkt+0x2c8/0x800 [hci_uart]\n  h5_rx_payload+0x98/0xb8 [hci_uart]\n  h5_recv+0x158/0x3d8 [hci_uart]\n  hci_uart_receive_buf+0xa0/0xe8 [hci_uart]\n  ttyport_receive_buf+0xac/0x178\n  flush_to_ldisc+0x130/0x2c8\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n\n Second to last potentially related work creation:\n  kasan_save_stack+0x3c/0x68\n  __kasan_record_aux_stack+0xb0/0x150\n  kasan_record_aux_stack_noalloc+0x14/0x20\n  __queue_work+0x788/0x960\n  queue_work_on+0x98/0xc0\n  __hci_cmd_sync_sk+0x23c/0x7a0 [bluetooth]\n  __hci_cmd_sync+0x24/0x38 [bluetooth]\n  btrtl_initialize+0x760/0x958 [btrtl]\n  h5_btrtl_setup+0xd0/0x2f8 [hci_uart]\n  h5_setup+0x50/0x80 [hci_uart]\n  hci_uart_setup+0xd4/0x260 [hci_uart]\n  hci_dev_open_sync+0x1cc/0xf68 [bluetooth]\n  hci_dev_do_open+0x34/0x90 [bluetooth]\n  hci_power_on+0xc4/0x3c8 [bluetooth]\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n =================================================================="
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The out-of-bounds access happens in the HCI device setup path (`h5_serdev_probe` \u2192 `hci_dev_open_sync` \u2192 `h5_btrtl_setup` \u2192 `btrtl_initialize`), driven entirely by local driver probe/open and locally loaded firmware, before any RF link exists. No network or adjacent-network data reaches the vulnerable code, and the UART-attached controller is a permanently soldered on-board device rather than a hot-plugged one.\nAC:L - The overflow is unconditional and fully deterministic \u2014 `sizeof_priv` is zero for every RTL H5 device, so every single `btrtl_initialize()`/`btrtl_download_firmware()` run writes past the end of the `hci_dev` allocation with no race, no timing window, and no memory grooming required. It reproduces on the first attempt on every affected system, as the reported KASAN splat from a stock PinePhone boot shows.\nPR:L - An unprivileged local session user on the affected phone/tablet/laptop class can re-trigger the write at will, because `h5_btrtl_resume()` performs a `device_reprobe()` on RTL8723BS parts and a suspend/resume cycle is permitted to active local sessions by default logind/polkit policy, re-running the full setup path. The write also fires with zero privileges during the automatic boot-time probe; the root/`CAP_NET_ADMIN`-gated `HCIDEVUP` ioctl is only one of several trigger routes, not a required one.\nUI:N - The out-of-bounds write executes in a kernel workqueue during automatic device probe and power-on, with no administrator or victim action of any kind. The suspend/resume re-trigger is initiated by the attacker\u0027s own process.\nS:U - The corruption is confined to the kernel slab of the same host and is exploited by, and against, the kernel\u0027s own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `btrtl_dmp_hdr()` reads the out-of-bounds `rtl_dump.controller` and `rtl_dump.driver_name` fields back as pointers and `snprintf(\"%s\", ...)`s them into a devcoredump buffer that userspace can read from `/sys/class/devcoredump/`; when that region overlaps a neighbouring slab object whose contents have since changed, this becomes a read of an attacker-influenceable kernel pointer and disclosure of arbitrary kernel memory. The out-of-bounds region also exposes adjacent heap contents to the driver\u0027s own logic (`btrealtek_test_flag`, firmware-version reporting).\nI:H - This is a confirmed slab out-of-bounds write (KASAN \"Write of size 8\") of up to 32 bytes \u2014 two kernel `.rodata` pointers, a firmware-derived `u32`, and a `set_bit()` \u2014 immediately past the `hci_dev` allocation, at a fixed and predictable offset. Depending on kernel version, architecture, and config (`sizeof(struct hci_dev)` relative to the kmalloc bucket, particularly on the 32-bit ARM boards that use this exact driver), those bytes land in the head of the adjacent heap object, giving a repeatable heap-overflow primitive that can be groomed by controlling what occupies the neighbouring slot.\nA:H - Corrupting the first bytes of a neighbouring kmalloc object, and later dereferencing pointers read back out of bounds in `btrtl_dmp_hdr()`, readily produces a kernel oops or panic; the access is repeated on every probe, resume, and device open. On builds with KASAN or arm64 MTE (shipped in production on some Android devices), the very first occurrence is a fatal report/panic, and `panic_on_warn`/`panic_on_oops` hardened embedded and automotive builds turn it into an immediate full system outage."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:11.662Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dd163fa34c483f1674aa2510accce11a224f649e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f232bc389a4f5943c40733582f9edf77b89e499"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c657e641df1e77d6087688190f632cad9c0439b"
        },
        {
          "url": "https://git.kernel.org/stable/c/de4e88ec58c4202efd1f02eebb4939bbf6945358"
        }
      ],
      "title": "Bluetooth: btrtl: fix out of bounds memory access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26890",
    "datePublished": "2024-04-17T10:27:43.438Z",
    "dateReserved": "2024-02-19T14:20:24.186Z",
    "dateUpdated": "2026-08-05T11:28:11.662Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26890",
      "date": "2026-09-18",
      "epss": "0.006",
      "percentile": "0.47345"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/bluetooth/hci_h5.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "dd163fa34c483f1674aa2510accce11a224f649e",
                    "status": "affected",
                    "version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2f232bc389a4f5943c40733582f9edf77b89e499",
                    "status": "affected",
                    "version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0c657e641df1e77d6087688190f632cad9c0439b",
                    "status": "affected",
                    "version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "de4e88ec58c4202efd1f02eebb4939bbf6945358",
                    "status": "affected",
                    "version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/bluetooth/hci_h5.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.2"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.23",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.7.*",
                    "status": "unaffected",
                    "version": "6.7.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.9",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E00814DC-0BA7-431A-9926-80FEB4A96C68",
                    "versionEndExcluding": "6.6.23",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD",
                    "versionEndExcluding": "6.7.11",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "543A75FF-25B8-4046-A514-1EA8EDD87AB1",
                    "versionEndExcluding": "6.8.2",
                    "versionStartIncluding": "6.8",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: fix out of bounds memory access\n\nThe problem is detected by KASAN.\nbtrtl driver uses private hci data to store \u0027struct btrealtek_data\u0027.\nIf btrtl driver is used with btusb, then memory for private hci data\nis allocated in btusb. But no private data is allocated after hci_dev,\nwhen btrtl is used with hci_h5.\n\nThis commit adds memory allocation for hci_h5 case.\n\n ==================================================================\n BUG: KASAN: slab-out-of-bounds in btrtl_initialize+0x6cc/0x958 [btrtl]\n Write of size 8 at addr ffff00000f5a5748 by task kworker/u9:0/76\n\n Hardware name: Pine64 PinePhone (1.2) (DT)\n Workqueue: hci0 hci_power_on [bluetooth]\n Call trace:\n  dump_backtrace+0x9c/0x128\n  show_stack+0x20/0x38\n  dump_stack_lvl+0x48/0x60\n  print_report+0xf8/0x5d8\n  kasan_report+0x90/0xd0\n  __asan_store8+0x9c/0xc0\n  \t [btrtl]\n  h5_btrtl_setup+0xd0/0x2f8 [hci_uart]\n  h5_setup+0x50/0x80 [hci_uart]\n  hci_uart_setup+0xd4/0x260 [hci_uart]\n  hci_dev_open_sync+0x1cc/0xf68 [bluetooth]\n  hci_dev_do_open+0x34/0x90 [bluetooth]\n  hci_power_on+0xc4/0x3c8 [bluetooth]\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n\n Allocated by task 53:\n  kasan_save_stack+0x3c/0x68\n  kasan_save_track+0x20/0x40\n  kasan_save_alloc_info+0x68/0x78\n  __kasan_kmalloc+0xd4/0xd8\n  __kmalloc+0x1b4/0x3b0\n  hci_alloc_dev_priv+0x28/0xa58 [bluetooth]\n  hci_uart_register_device+0x118/0x4f8 [hci_uart]\n  h5_serdev_probe+0xf4/0x178 [hci_uart]\n  serdev_drv_probe+0x54/0xa0\n  really_probe+0x254/0x588\n  __driver_probe_device+0xc4/0x210\n  driver_probe_device+0x64/0x160\n  __driver_attach_async_helper+0x88/0x158\n  async_run_entry_fn+0xd0/0x388\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n\n Last potentially related work creation:\n  kasan_save_stack+0x3c/0x68\n  __kasan_record_aux_stack+0xb0/0x150\n  kasan_record_aux_stack_noalloc+0x14/0x20\n  __queue_work+0x33c/0x960\n  queue_work_on+0x98/0xc0\n  hci_recv_frame+0xc8/0x1e8 [bluetooth]\n  h5_complete_rx_pkt+0x2c8/0x800 [hci_uart]\n  h5_rx_payload+0x98/0xb8 [hci_uart]\n  h5_recv+0x158/0x3d8 [hci_uart]\n  hci_uart_receive_buf+0xa0/0xe8 [hci_uart]\n  ttyport_receive_buf+0xac/0x178\n  flush_to_ldisc+0x130/0x2c8\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n\n Second to last potentially related work creation:\n  kasan_save_stack+0x3c/0x68\n  __kasan_record_aux_stack+0xb0/0x150\n  kasan_record_aux_stack_noalloc+0x14/0x20\n  __queue_work+0x788/0x960\n  queue_work_on+0x98/0xc0\n  __hci_cmd_sync_sk+0x23c/0x7a0 [bluetooth]\n  __hci_cmd_sync+0x24/0x38 [bluetooth]\n  btrtl_initialize+0x760/0x958 [btrtl]\n  h5_btrtl_setup+0xd0/0x2f8 [hci_uart]\n  h5_setup+0x50/0x80 [hci_uart]\n  hci_uart_setup+0xd4/0x260 [hci_uart]\n  hci_dev_open_sync+0x1cc/0xf68 [bluetooth]\n  hci_dev_do_open+0x34/0x90 [bluetooth]\n  hci_power_on+0xc4/0x3c8 [bluetooth]\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n =================================================================="
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: Bluetooth: btrtl: arreglar acceso a memoria fuera de los l\u00edmites El problema es detectado por KASAN. El controlador btrtl utiliza datos privados de hci para almacenar \u0027struct btrealtek_data\u0027. Si se utiliza el controlador btrtl con btusb, entonces la memoria para los datos privados de hci se asigna en btusb. Pero no se asignan datos privados despu\u00e9s de hci_dev, cuando se usa btrtl con hci_h5. Esta confirmaci\u00f3n agrega asignaci\u00f3n de memoria para el caso hci_h5. ==================================================== ================ ERROR: KASAN: losa fuera de los l\u00edmites en btrtl_initialize+0x6cc/0x958 [btrtl] Escritura de tama\u00f1o 8 en la direcci\u00f3n ffff00000f5a5748 por tarea kworker/u9:0 /76 Nombre del hardware: Pine64 PinePhone (1.2) (DT) Cola de trabajo: hci0 hci_power_on [bluetooth] Rastreo de llamadas: dump_backtrace+0x9c/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5d8 kasan_report+0x90/0xd0 __asan_store8 + 0x9c/0xc0 [btrtl] h5_btrtl_setup+0xd0/0x2f8 [hci_uart] h5_setup+0x50/0x80 [hci_uart] hci_uart_setup+0xd4/0x260 [hci_uart] hci_dev_open_sync+0x1cc/0xf68 [bluetooth] abierto+0x34/0x90 [bluetooth] hci_power_on+0xc4/ 0x3c8 [bluetooth] Process_one_work+0x328/0x6f0 trabajador_thread+0x410/0x778 kthread+0x168/0x178 ret_from_fork+0x10/0x20 Asignado por tarea 53: kasan_save_stack+0x3c/0x68 kasan_save_track+0x20/0x40 _alloc_info+0x68/0x78 __kasan_kmalloc+0xd4/0xd8 __kmalloc +0x1b4/0x3b0 hci_alloc_dev_priv+0x28/0xa58 [bluetooth] hci_uart_register_device+0x118/0x4f8 [hci_uart] h5_serdev_probe+0xf4/0x178 [hci_uart] serdev_drv_probe+0x54/0xa0realmente_probe+0x254/ 0x588 __driver_probe_device+0xc4/0x210 driver_probe_device+0x64/0x160 __driver_attach_async_helper+ 0x88/0x158 async_run_entry_fn+0xd0/0x388 Process_one_work+0x328/0x6f0 trabajador_thread+0x410/0x778 kthread+0x168/0x178 ret_from_fork+0x10/0x20 \u00daltima creaci\u00f3n de trabajo potencialmente relacionado: kasan_save_stack+0x3c/0x68 san_record_aux_stack+0xb0/0x150 kasan_record_aux_stack_noalloc+0x14/0x20 __queue_work +0x33c/0x960 queue_work_on+0x98/0xc0 hci_recv_frame+0xc8/0x1e8 [bluetooth] h5_complete_rx_pkt+0x2c8/0x800 [hci_uart] h5_rx_payload+0x98/0xb8 [hci_uart] h5_recv+0x158/0x3d8 [ hci_uart] hci_uart_receive_buf+0xa0/0xe8 [hci_uart] ttyport_receive_buf +0xac/0x178 Flush_to_ldisc+0x130/0x2c8 Process_one_work+0x328/0x6f0 trabajador_thread+0x410/0x778 kthread+0x168/0x178 ret_from_fork+0x10/0x20 Pen\u00faltima creaci\u00f3n de trabajo potencialmente relacionado: kasan_save_stack+0x3c/0x68 _record_aux_stack+0xb0/0x150 kasan_record_aux_stack_noalloc+0x14 /0x20 __queue_work+0x788/0x960 queue_work_on+0x98/0xc0 __hci_cmd_sync_sk+0x23c/0x7a0 [bluetooth] __hci_cmd_sync+0x24/0x38 [bluetooth] btrtl_initialize+0x760/0x958 [btrtl] arriba+0xd0/0x2f8 [hci_uart] h5_setup+0x50/0x80 [ hci_uart] hci_uart_setup+0xd4/0x260 [hci_uart] hci_dev_open_sync+0x1cc/0xf68 [bluetooth] hci_dev_do_open+0x34/0x90 [bluetooth] hci_power_on+0xc4/0x3c8 [bluetooth] Process_one_work+0x328/0x6f0 trabajador_thread+0x 410/0x778 kthread+0x168/0x178 ret_from_fork +0x10/0x20 ================================================ ====================="
          }
        ],
        "id": "CVE-2024-26890",
        "lastModified": "2026-08-04T11:17:18.840",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 2.5,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-26890",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-16T15:26:42.807885Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-17T11:15:10.423",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0c657e641df1e77d6087688190f632cad9c0439b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2f232bc389a4f5943c40733582f9edf77b89e499"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dd163fa34c483f1674aa2510accce11a224f649e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/de4e88ec58c4202efd1f02eebb4939bbf6945358"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0c657e641df1e77d6087688190f632cad9c0439b"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2f232bc389a4f5943c40733582f9edf77b89e499"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dd163fa34c483f1674aa2510accce11a224f649e"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/de4e88ec58c4202efd1f02eebb4939bbf6945358"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:49:39+00:00",
      "cve": "CVE-2024-26890",
      "id": "CVE-2024-26890",
      "initial_release_date": "2024-04-17T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "56",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: btrtl: fix out of bounds memory access",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26890.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T00:21:05.409Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/dd163fa34c483f1674aa2510accce11a224f649e"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/2f232bc389a4f5943c40733582f9edf77b89e499"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/0c657e641df1e77d6087688190f632cad9c0439b"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/de4e88ec58c4202efd1f02eebb4939bbf6945358"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "LOW",
                  "baseScore": 6.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "LOW",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-26890",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-07-16T15:26:42.807885Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-125",
                    "description": "CWE-125 Out-of-bounds Read",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-07-16T15:26:53.419Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/bluetooth/hci_h5.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "dd163fa34c483f1674aa2510accce11a224f649e",
                  "status": "affected",
                  "version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
                  "versionType": "git"
                },
                {
                  "lessThan": "2f232bc389a4f5943c40733582f9edf77b89e499",
                  "status": "affected",
                  "version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
                  "versionType": "git"
                },
                {
                  "lessThan": "0c657e641df1e77d6087688190f632cad9c0439b",
                  "status": "affected",
                  "version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
                  "versionType": "git"
                },
                {
                  "lessThan": "de4e88ec58c4202efd1f02eebb4939bbf6945358",
                  "status": "affected",
                  "version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/bluetooth/hci_h5.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.2"
                },
                {
                  "lessThan": "6.2",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.23",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.7.*",
                  "status": "unaffected",
                  "version": "6.7.11",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.9",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.23",
                      "versionStartIncluding": "6.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.7.11",
                      "versionStartIncluding": "6.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.2",
                      "versionStartIncluding": "6.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9",
                      "versionStartIncluding": "6.2",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: fix out of bounds memory access\n\nThe problem is detected by KASAN.\nbtrtl driver uses private hci data to store \u0027struct btrealtek_data\u0027.\nIf btrtl driver is used with btusb, then memory for private hci data\nis allocated in btusb. But no private data is allocated after hci_dev,\nwhen btrtl is used with hci_h5.\n\nThis commit adds memory allocation for hci_h5 case.\n\n ==================================================================\n BUG: KASAN: slab-out-of-bounds in btrtl_initialize+0x6cc/0x958 [btrtl]\n Write of size 8 at addr ffff00000f5a5748 by task kworker/u9:0/76\n\n Hardware name: Pine64 PinePhone (1.2) (DT)\n Workqueue: hci0 hci_power_on [bluetooth]\n Call trace:\n  dump_backtrace+0x9c/0x128\n  show_stack+0x20/0x38\n  dump_stack_lvl+0x48/0x60\n  print_report+0xf8/0x5d8\n  kasan_report+0x90/0xd0\n  __asan_store8+0x9c/0xc0\n  \t [btrtl]\n  h5_btrtl_setup+0xd0/0x2f8 [hci_uart]\n  h5_setup+0x50/0x80 [hci_uart]\n  hci_uart_setup+0xd4/0x260 [hci_uart]\n  hci_dev_open_sync+0x1cc/0xf68 [bluetooth]\n  hci_dev_do_open+0x34/0x90 [bluetooth]\n  hci_power_on+0xc4/0x3c8 [bluetooth]\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n\n Allocated by task 53:\n  kasan_save_stack+0x3c/0x68\n  kasan_save_track+0x20/0x40\n  kasan_save_alloc_info+0x68/0x78\n  __kasan_kmalloc+0xd4/0xd8\n  __kmalloc+0x1b4/0x3b0\n  hci_alloc_dev_priv+0x28/0xa58 [bluetooth]\n  hci_uart_register_device+0x118/0x4f8 [hci_uart]\n  h5_serdev_probe+0xf4/0x178 [hci_uart]\n  serdev_drv_probe+0x54/0xa0\n  really_probe+0x254/0x588\n  __driver_probe_device+0xc4/0x210\n  driver_probe_device+0x64/0x160\n  __driver_attach_async_helper+0x88/0x158\n  async_run_entry_fn+0xd0/0x388\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n\n Last potentially related work creation:\n  kasan_save_stack+0x3c/0x68\n  __kasan_record_aux_stack+0xb0/0x150\n  kasan_record_aux_stack_noalloc+0x14/0x20\n  __queue_work+0x33c/0x960\n  queue_work_on+0x98/0xc0\n  hci_recv_frame+0xc8/0x1e8 [bluetooth]\n  h5_complete_rx_pkt+0x2c8/0x800 [hci_uart]\n  h5_rx_payload+0x98/0xb8 [hci_uart]\n  h5_recv+0x158/0x3d8 [hci_uart]\n  hci_uart_receive_buf+0xa0/0xe8 [hci_uart]\n  ttyport_receive_buf+0xac/0x178\n  flush_to_ldisc+0x130/0x2c8\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n\n Second to last potentially related work creation:\n  kasan_save_stack+0x3c/0x68\n  __kasan_record_aux_stack+0xb0/0x150\n  kasan_record_aux_stack_noalloc+0x14/0x20\n  __queue_work+0x788/0x960\n  queue_work_on+0x98/0xc0\n  __hci_cmd_sync_sk+0x23c/0x7a0 [bluetooth]\n  __hci_cmd_sync+0x24/0x38 [bluetooth]\n  btrtl_initialize+0x760/0x958 [btrtl]\n  h5_btrtl_setup+0xd0/0x2f8 [hci_uart]\n  h5_setup+0x50/0x80 [hci_uart]\n  hci_uart_setup+0xd4/0x260 [hci_uart]\n  hci_dev_open_sync+0x1cc/0xf68 [bluetooth]\n  hci_dev_do_open+0x34/0x90 [bluetooth]\n  hci_power_on+0xc4/0x3c8 [bluetooth]\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n =================================================================="
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The out-of-bounds access happens in the HCI device setup path (`h5_serdev_probe` \u2192 `hci_dev_open_sync` \u2192 `h5_btrtl_setup` \u2192 `btrtl_initialize`), driven entirely by local driver probe/open and locally loaded firmware, before any RF link exists. No network or adjacent-network data reaches the vulnerable code, and the UART-attached controller is a permanently soldered on-board device rather than a hot-plugged one.\nAC:L - The overflow is unconditional and fully deterministic \u2014 `sizeof_priv` is zero for every RTL H5 device, so every single `btrtl_initialize()`/`btrtl_download_firmware()` run writes past the end of the `hci_dev` allocation with no race, no timing window, and no memory grooming required. It reproduces on the first attempt on every affected system, as the reported KASAN splat from a stock PinePhone boot shows.\nPR:L - An unprivileged local session user on the affected phone/tablet/laptop class can re-trigger the write at will, because `h5_btrtl_resume()` performs a `device_reprobe()` on RTL8723BS parts and a suspend/resume cycle is permitted to active local sessions by default logind/polkit policy, re-running the full setup path. The write also fires with zero privileges during the automatic boot-time probe; the root/`CAP_NET_ADMIN`-gated `HCIDEVUP` ioctl is only one of several trigger routes, not a required one.\nUI:N - The out-of-bounds write executes in a kernel workqueue during automatic device probe and power-on, with no administrator or victim action of any kind. The suspend/resume re-trigger is initiated by the attacker\u0027s own process.\nS:U - The corruption is confined to the kernel slab of the same host and is exploited by, and against, the kernel\u0027s own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `btrtl_dmp_hdr()` reads the out-of-bounds `rtl_dump.controller` and `rtl_dump.driver_name` fields back as pointers and `snprintf(\"%s\", ...)`s them into a devcoredump buffer that userspace can read from `/sys/class/devcoredump/`; when that region overlaps a neighbouring slab object whose contents have since changed, this becomes a read of an attacker-influenceable kernel pointer and disclosure of arbitrary kernel memory. The out-of-bounds region also exposes adjacent heap contents to the driver\u0027s own logic (`btrealtek_test_flag`, firmware-version reporting).\nI:H - This is a confirmed slab out-of-bounds write (KASAN \"Write of size 8\") of up to 32 bytes \u2014 two kernel `.rodata` pointers, a firmware-derived `u32`, and a `set_bit()` \u2014 immediately past the `hci_dev` allocation, at a fixed and predictable offset. Depending on kernel version, architecture, and config (`sizeof(struct hci_dev)` relative to the kmalloc bucket, particularly on the 32-bit ARM boards that use this exact driver), those bytes land in the head of the adjacent heap object, giving a repeatable heap-overflow primitive that can be groomed by controlling what occupies the neighbouring slot.\nA:H - Corrupting the first bytes of a neighbouring kmalloc object, and later dereferencing pointers read back out of bounds in `btrtl_dmp_hdr()`, readily produces a kernel oops or panic; the access is repeated on every probe, resume, and device open. On builds with KASAN or arm64 MTE (shipped in production on some Android devices), the very first occurrence is a fatal report/panic, and `panic_on_warn`/`panic_on_oops` hardened embedded and automotive builds turn it into an immediate full system outage."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:28:11.662Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/dd163fa34c483f1674aa2510accce11a224f649e"
            },
            {
              "url": "https://git.kernel.org/stable/c/2f232bc389a4f5943c40733582f9edf77b89e499"
            },
            {
              "url": "https://git.kernel.org/stable/c/0c657e641df1e77d6087688190f632cad9c0439b"
            },
            {
              "url": "https://git.kernel.org/stable/c/de4e88ec58c4202efd1f02eebb4939bbf6945358"
            }
          ],
          "title": "Bluetooth: btrtl: fix out of bounds memory access",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-26890",
        "datePublished": "2024-04-17T10:27:43.438Z",
        "dateReserved": "2024-02-19T14:20:24.186Z",
        "dateUpdated": "2026-08-05T11:28:11.662Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.