GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-58241 (GCVE-0-2024-58241)

Vulnerability from cvelistv5 – Published: 2025-09-24 11:02 – Updated: 2026-08-05 11:47
VLAI
Title
Bluetooth: hci_core: Disable works on hci_unregister_dev
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Disable works on hci_unregister_dev This make use of disable_work_* on hci_unregister_dev since the hci_dev is about to be freed new submissions are not disarable.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 19:27 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0d151a103775dd9645c78c97f77d6e2a5298d913 , < cfdb13a54e05eb98d9940cb6d1a13e7f994d811f (git)
Affected: 0d151a103775dd9645c78c97f77d6e2a5298d913 , < 989fa5171f005ecf63440057218d8aeb1795287d (git)
Affected: 48542881997e17b49dc16b93fe910e0cfcf7a9f9 (git)
Affected: 9cfc84b1d464cc024286f42a090718f9067b80ed (git)
Affected: ddeda6ca5f218b668b560d90fc31ae469adbfd92 (git)
Affected: d2ce562a5aff1dcd0c50d9808ea825ef90da909f (git)
Affected: 96600c2e5ee8213dbab5df1617293d8e847bb4fa (git)
Affected: d6cbce18370641a21dd889e8613d8153df15eb39 (git)
Affected: 3f939bd73fed12dddc2a32a76116c19ca47c7678 (git)
Affected: 4.19.319 , < 4.20 (semver)
Affected: 5.4.281 , < 5.5 (semver)
Affected: 5.10.223 , < 5.11 (semver)
Affected: 5.15.164 , < 5.16 (semver)
Affected: 6.1.101 , < 6.2 (semver)
Affected: 6.6.42 , < 6.7 (semver)
Affected: 6.9.11 , < 6.10 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.11.6 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-58241",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:27:13.634152Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:33:13.304Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c",
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cfdb13a54e05eb98d9940cb6d1a13e7f994d811f",
              "status": "affected",
              "version": "0d151a103775dd9645c78c97f77d6e2a5298d913",
              "versionType": "git"
            },
            {
              "lessThan": "989fa5171f005ecf63440057218d8aeb1795287d",
              "status": "affected",
              "version": "0d151a103775dd9645c78c97f77d6e2a5298d913",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "48542881997e17b49dc16b93fe910e0cfcf7a9f9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9cfc84b1d464cc024286f42a090718f9067b80ed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ddeda6ca5f218b668b560d90fc31ae469adbfd92",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d2ce562a5aff1dcd0c50d9808ea825ef90da909f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "96600c2e5ee8213dbab5df1617293d8e847bb4fa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d6cbce18370641a21dd889e8613d8153df15eb39",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3f939bd73fed12dddc2a32a76116c19ca47c7678",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.319",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.281",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.223",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.164",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.101",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.42",
              "versionType": "semver"
            },
            {
              "lessThan": "6.10",
              "status": "affected",
              "version": "6.9.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c",
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.319",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.281",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.223",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.164",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.101",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.42",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.9.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Disable works on hci_unregister_dev\n\nThis make use of disable_work_* on hci_unregister_dev since the hci_dev is\nabout to be freed new submissions are not disarable."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering the vulnerable window requires initiating HCI device teardown (`hci_unregister_dev()`), reachable locally via `/dev/vhci` close, HCI ldisc detach, or adapter down/removal \u2014 an adjacent Bluetooth peer can influence HCI traffic but cannot cause device unregistration. All required primitives are local syscalls (open/write/close/ioctl on a device node and Bluetooth sockets).\nAC:L - The attacker controls both sides of the race \u2014 it drives the unregister (closing the vhci fd) while concurrently feeding HCI packets/commands that re-queue `rx_work`/`cmd_work`/`error_reset` \u2014 and can retry the open/close cycle indefinitely to win it and to spray the freed `hci_dev` slab. The `cmd_timer`/`ncmd_timer` re-arm even occurs on the unregister path itself via `hci_dev_close_sync()`, requiring no external timing luck.\nPR:L - No capability check exists anywhere on the path: `vhci_open()` performs no `capable()` test, so an unprivileged user granted the device node (containers, Android\u0027s bluetooth uid, permissive udev rules) can create and destroy HCI devices and inject HCI frames at will. This matches the PR:L assignment for the structurally identical `hci_unregister_dev` teardown UAF CVE-2025-38250.\nUI:N - The attacker performs both the device teardown and the concurrent work re-submission entirely from its own processes. No victim action or cooperation is needed.\nS:U - The corruption is confined to kernel slab memory and workqueue structures within the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - A work_struct/delayed_work embedded in the freed `hci_dev` is dereferenced after `kfree()`, and `__queue_work()` follows the stale `dwork-\u003ewq` pointer into a destroyed workqueue. Controlled reallocation of the freed object turns this into an arbitrary-read primitive and leaks kernel pointers/heap contents.\nI:H - The same use-after-free lets the attacker place controlled data in the reclaimed `hci_dev` slab so that the firing timer operates on attacker-supplied `workqueue_struct`/`pool_workqueue`/list pointers and work function pointers, yielding arbitrary write and control-flow hijack. Per kernel scoring guidance, a UAF exploitable for heap spraying is High integrity impact.\nA:H - Even unexploited, the stale timer queuing onto a destroyed workqueue causes a KASAN slab-use-after-free oops and kernel panic, and `destroy_workqueue()` with still-pending work triggers a WARN and leaves the workqueue broken. Re-queued `error_reset` additionally reintroduces the `destroy_workqueue()` self-flush deadlock that hangs the req_workqueue."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:51.227Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cfdb13a54e05eb98d9940cb6d1a13e7f994d811f"
        },
        {
          "url": "https://git.kernel.org/stable/c/989fa5171f005ecf63440057218d8aeb1795287d"
        }
      ],
      "title": "Bluetooth: hci_core: Disable works on hci_unregister_dev",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58241",
    "datePublished": "2025-09-24T11:02:49.948Z",
    "dateReserved": "2025-04-16T07:19:43.805Z",
    "dateUpdated": "2026-08-05T11:47:51.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-58241",
      "date": "2026-09-17",
      "epss": "0.00134",
      "percentile": "0.03299"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-10T14:47:48.000Z",
      "cve": "CVE-2024-58241",
      "id": "msrc_CVE-2024-58241",
      "initial_release_date": "2025-12-14T14:02:10.000Z",
      "product_status:known_affected": "19",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: hci_core: Disable works on hci_unregister_dev",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-58241.json",
      "version": "18"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-58241\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-24T11:15:31.877\",\"lastModified\":\"2026-08-04T11:22:40.900\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: hci_core: Disable works on hci_unregister_dev\\n\\nThis make use of disable_work_* on hci_unregister_dev since the hci_dev is\\nabout to be freed new submissions are not disarable.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/hci_core.c\",\"net/bluetooth/hci_sync.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0d151a103775dd9645c78c97f77d6e2a5298d913\",\"lessThan\":\"cfdb13a54e05eb98d9940cb6d1a13e7f994d811f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0d151a103775dd9645c78c97f77d6e2a5298d913\",\"lessThan\":\"989fa5171f005ecf63440057218d8aeb1795287d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48542881997e17b49dc16b93fe910e0cfcf7a9f9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9cfc84b1d464cc024286f42a090718f9067b80ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ddeda6ca5f218b668b560d90fc31ae469adbfd92\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d2ce562a5aff1dcd0c50d9808ea825ef90da909f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"96600c2e5ee8213dbab5df1617293d8e847bb4fa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d6cbce18370641a21dd889e8613d8153df15eb39\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3f939bd73fed12dddc2a32a76116c19ca47c7678\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.19.319\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.281\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.223\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.164\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.101\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.42\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.9.11\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/hci_core.c\",\"net/bluetooth/hci_sync.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.6\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-14T19:27:13.634152Z\",\"id\":\"CVE-2024-58241\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.319\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"F37BEA92-84F4-48E4-9A23-4AE307A90C01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.281\",\"versionEndExcluding\":\"5.5\",\"matchCriteriaId\":\"9247B8C6-D97A-4CCC-B960-AFD2F536EFC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.223\",\"versionEndExcluding\":\"5.11\",\"matchCriteriaId\":\"CA30912E-AC28-4CAA-B0BF-82A5ABF6555D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.164\",\"versionEndExcluding\":\"5.16\",\"matchCriteriaId\":\"8389AA82-2449-4F7C-B48A-C852C9E6CECC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.101\",\"versionEndExcluding\":\"6.2\",\"matchCriteriaId\":\"3E15CEDD-954C-4293-93C4-8395B1C0992C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.42\",\"versionEndExcluding\":\"6.7\",\"matchCriteriaId\":\"A25948DB-570B-4AAC-BFAE-708742265749\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9.11\",\"versionEndExcluding\":\"6.10\",\"matchCriteriaId\":\"9CE730C5-2CF2-4D9D-A672-6BC72F34532C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10.1\",\"versionEndExcluding\":\"6.11.6\",\"matchCriteriaId\":\"632208BB-D888-4D9F-8D24-2BD9A48949D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EA80796-744E-45F5-8632-2AB4F7889FCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"11AF4CB9-F697-4EA4-8903-8F9417EFDA8E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/989fa5171f005ecf63440057218d8aeb1795287d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cfdb13a54e05eb98d9940cb6d1a13e7f994d811f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T23:04:42+00:00",
      "cve": "CVE-2024-58241",
      "id": "CVE-2024-58241",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_affected": "122",
      "product_status:known_not_affected": "152",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Kernel: Bluetooth HCI local DoS",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-58241.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-58241\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T19:27:13.634152Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T19:27:08.766Z\"}}], \"cna\": {\"title\": \"Bluetooth: hci_core: Disable works on hci_unregister_dev\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Triggering the vulnerable window requires initiating HCI device teardown (`hci_unregister_dev()`), reachable locally via `/dev/vhci` close, HCI ldisc detach, or adapter down/removal \\u2014 an adjacent Bluetooth peer can influence HCI traffic but cannot cause device unregistration. All required primitives are local syscalls (open/write/close/ioctl on a device node and Bluetooth sockets).\\nAC:L - The attacker controls both sides of the race \\u2014 it drives the unregister (closing the vhci fd) while concurrently feeding HCI packets/commands that re-queue `rx_work`/`cmd_work`/`error_reset` \\u2014 and can retry the open/close cycle indefinitely to win it and to spray the freed `hci_dev` slab. The `cmd_timer`/`ncmd_timer` re-arm even occurs on the unregister path itself via `hci_dev_close_sync()`, requiring no external timing luck.\\nPR:L - No capability check exists anywhere on the path: `vhci_open()` performs no `capable()` test, so an unprivileged user granted the device node (containers, Android\u0027s bluetooth uid, permissive udev rules) can create and destroy HCI devices and inject HCI frames at will. This matches the PR:L assignment for the structurally identical `hci_unregister_dev` teardown UAF CVE-2025-38250.\\nUI:N - The attacker performs both the device teardown and the concurrent work re-submission entirely from its own processes. No victim action or cooperation is needed.\\nS:U - The corruption is confined to kernel slab memory and workqueue structures within the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - A work_struct/delayed_work embedded in the freed `hci_dev` is dereferenced after `kfree()`, and `__queue_work()` follows the stale `dwork-\u003ewq` pointer into a destroyed workqueue. Controlled reallocation of the freed object turns this into an arbitrary-read primitive and leaks kernel pointers/heap contents.\\nI:H - The same use-after-free lets the attacker place controlled data in the reclaimed `hci_dev` slab so that the firing timer operates on attacker-supplied `workqueue_struct`/`pool_workqueue`/list pointers and work function pointers, yielding arbitrary write and control-flow hijack. Per kernel scoring guidance, a UAF exploitable for heap spraying is High integrity impact.\\nA:H - Even unexploited, the stale timer queuing onto a destroyed workqueue causes a KASAN slab-use-after-free oops and kernel panic, and `destroy_workqueue()` with still-pending work triggers a WARN and leaves the workqueue broken. Re-queued `error_reset` additionally reintroduces the `destroy_workqueue()` self-flush deadlock that hangs the req_workqueue.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0d151a103775dd9645c78c97f77d6e2a5298d913\", \"lessThan\": \"cfdb13a54e05eb98d9940cb6d1a13e7f994d811f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0d151a103775dd9645c78c97f77d6e2a5298d913\", \"lessThan\": \"989fa5171f005ecf63440057218d8aeb1795287d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"48542881997e17b49dc16b93fe910e0cfcf7a9f9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9cfc84b1d464cc024286f42a090718f9067b80ed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ddeda6ca5f218b668b560d90fc31ae469adbfd92\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d2ce562a5aff1dcd0c50d9808ea825ef90da909f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"96600c2e5ee8213dbab5df1617293d8e847bb4fa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d6cbce18370641a21dd889e8613d8153df15eb39\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3f939bd73fed12dddc2a32a76116c19ca47c7678\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.19.319\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.281\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.223\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.164\", \"lessThan\": \"5.16\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.101\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.6.42\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.9.11\", \"lessThan\": \"6.10\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/bluetooth/hci_core.c\", \"net/bluetooth/hci_sync.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/bluetooth/hci_core.c\", \"net/bluetooth/hci_sync.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/cfdb13a54e05eb98d9940cb6d1a13e7f994d811f\"}, {\"url\": \"https://git.kernel.org/stable/c/989fa5171f005ecf63440057218d8aeb1795287d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: hci_core: Disable works on hci_unregister_dev\\n\\nThis make use of disable_work_* on hci_unregister_dev since the hci_dev is\\nabout to be freed new submissions are not disarable.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.6\", \"versionStartIncluding\": \"6.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.319\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.4.281\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.10.223\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.15.164\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.1.101\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.6.42\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.9.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:47:51.227Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-58241\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:47:51.227Z\", \"dateReserved\": \"2025-04-16T07:19:43.805Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-24T11:02:49.948Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.