CVE-2024-41062

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-41062", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.627Z", "datePublished": "2024-07-29T14:57:24.352Z", "dateUpdated": "2026-10-03T10:55:10.849Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:55:10.849Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbluetooth/l2cap: sync sock recv cb and release\n\nThe problem occurs between the system call to close the sock and hci_rx_work,\nwhere the former releases the sock and the latter accesses it without lock protection.\n\n CPU0 CPU1\n ---- ----\n sock_close hci_rx_work\n\t l2cap_sock_release hci_acldata_packet\n\t l2cap_sock_kill l2cap_recv_frame\n\t sk_free l2cap_conless_channel\n\t l2cap_sock_recv_cb\n\nIf hci_rx_work processes the data that needs to be received before the sock is\nclosed, then everything is normal; Otherwise, the work thread may access the\nreleased sock when receiving data.\n\nAdd a chan mutex in the rx callback of the sock to achieve synchronization between\nthe sock release and recv cb.\n\nSock is dead, so set chan data to NULL, avoid others use invalid sock pointer."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The freed socket is dereferenced while processing an L2CAP connectionless frame (CID 0x0002) arriving over a BR/EDR ACL link from a peer device, so the attacker must be within Bluetooth radio range of the target. Per kernel CNA convention Bluetooth-reachable code is Adjacent.\nAC:L - The attacker drives the receive side of the race directly and can retry indefinitely at high packet rate with no authentication gate, rate limit, or state requirement, while the freeing side is ordinary L2CAP socket teardown that the attacker can induce or that an unprivileged local process performs in a tight bind/close loop. Under the rule that attacker-drivable races score Low, and choosing the higher severity where uncertain, AC:L.\nPR:N - l2cap_conless_channel() contains no security check whatsoever \u2014 no pairing, no authentication, no encryption, and no hci_conn_check_link_mode() call as exists in the connection-oriented l2cap_connect() path \u2014 so an unpaired, unauthenticated device that establishes an ACL link to a connectable target can reach the vulnerable callback. On the local side, creating an AF_BLUETOOTH SOCK_DGRAM socket and binding a dynamic PSM (>= 0x1001) requires no capability at all.\nUI:N - The vulnerable path is driven entirely by inbound HCI ACL data processed asynchronously in hci_rx_work and by normal socket teardown; no victim action such as accepting a pairing request, opening a file, or mounting anything is needed.\nS:U - The use-after-free corrupts kernel heap memory and is exploited within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on struct l2cap_pinfo, which is allocated from generic kmalloc caches (proto_register with alloc_slab=0), so the attacker can reclaim the freed object with controlled content and turn the subsequent reads of pi->rx_busy, sk->sk_rcvbuf and sk->sk_rmem_alloc into an arbitrary kernel-memory read primitive.\nI:H - The stale pointer is written through \u2014 lock_sock(), skb_set_owner_r(), and __skb_queue_tail() into sk->sk_receive_queue give controlled-pointer writes \u2014 and __sock_queue_rcv_skb() then performs an indirect call via sk->sk_data_ready(sk) using a function pointer read out of the freed object, yielding control-flow hijack and arbitrary write.\nA:H - Even without successful heap grooming, dereferencing and locking a freed sock reliably produces a KASAN slab-use-after-free, list corruption, or an oops/panic in hci_rx_work, taking down the kernel; this is exactly what syzbot (b7f6f8c9303466e16c8a) reported."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/l2cap_sock.c"], "versions": [{"version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "lessThan": "59a3ccd749b2550392ee531b4d727022eae4c89f", "status": "affected", "versionType": "git"}, {"version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "lessThan": "9c0b7d61cf3c00f87f2529b5b8b785f0f65089aa", "status": "affected", "versionType": "git"}, {"version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "lessThan": "605572e64cd9cebb05ed609d96cff05b50d18cdf", "status": "affected", "versionType": "git"}, {"version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "lessThan": "b803f30ea23e0968b6c8285c42adf0d862ab2bf6", "status": "affected", "versionType": "git"}, {"version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "lessThan": "3b732449b78183d17178db40be3a4401cf3cd629", "status": "affected", "versionType": "git"}, {"version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "lessThan": "89e856e124f9ae548572c56b1b70c2255705f8fe", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/l2cap_sock.c"], "versions": [{"version": "3.4", "status": "affected"}, {"version": "0", "lessThan": "3.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.101", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.42", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.11", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "6.1.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "6.6.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "6.9.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/59a3ccd749b2550392ee531b4d727022eae4c89f"}, {"url": "https://git.kernel.org/stable/c/9c0b7d61cf3c00f87f2529b5b8b785f0f65089aa"}, {"url": "https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf"}, {"url": "https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6"}, {"url": "https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629"}, {"url": "https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe"}], "title": "bluetooth/l2cap: sync sock recv cb and release", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:00:10.323Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-41062", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:22:05.690775Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:32:59.338Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:00:10.323Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-41062", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:22:05.690775Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:13.945Z"}}], "cna": {"title": "bluetooth/l2cap: sync sock recv cb and release", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The freed socket is dereferenced while processing an L2CAP connectionless frame (CID 0x0002) arriving over a BR/EDR ACL link from a peer device, so the attacker must be within Bluetooth radio range of the target. Per kernel CNA convention Bluetooth-reachable code is Adjacent.\nAC:L - The attacker drives the receive side of the race directly and can retry indefinitely at high packet rate with no authentication gate, rate limit, or state requirement, while the freeing side is ordinary L2CAP socket teardown that the attacker can induce or that an unprivileged local process performs in a tight bind/close loop. Under the rule that attacker-drivable races score Low, and choosing the higher severity where uncertain, AC:L.\nPR:N - l2cap_conless_channel() contains no security check whatsoever \u2014 no pairing, no authentication, no encryption, and no hci_conn_check_link_mode() call as exists in the connection-oriented l2cap_connect() path \u2014 so an unpaired, unauthenticated device that establishes an ACL link to a connectable target can reach the vulnerable callback. On the local side, creating an AF_BLUETOOTH SOCK_DGRAM socket and binding a dynamic PSM (>= 0x1001) requires no capability at all.\nUI:N - The vulnerable path is driven entirely by inbound HCI ACL data processed asynchronously in hci_rx_work and by normal socket teardown; no victim action such as accepting a pairing request, opening a file, or mounting anything is needed.\nS:U - The use-after-free corrupts kernel heap memory and is exploited within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on struct l2cap_pinfo, which is allocated from generic kmalloc caches (proto_register with alloc_slab=0), so the attacker can reclaim the freed object with controlled content and turn the subsequent reads of pi->rx_busy, sk->sk_rcvbuf and sk->sk_rmem_alloc into an arbitrary kernel-memory read primitive.\nI:H - The stale pointer is written through \u2014 lock_sock(), skb_set_owner_r(), and __skb_queue_tail() into sk->sk_receive_queue give controlled-pointer writes \u2014 and __sock_queue_rcv_skb() then performs an indirect call via sk->sk_data_ready(sk) using a function pointer read out of the freed object, yielding control-flow hijack and arbitrary write.\nA:H - Even without successful heap grooming, dereferencing and locking a freed sock reliably produces a KASAN slab-use-after-free, list corruption, or an oops/panic in hci_rx_work, taking down the kernel; this is exactly what syzbot (b7f6f8c9303466e16c8a) reported."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "lessThan": "59a3ccd749b2550392ee531b4d727022eae4c89f", "versionType": "git"}, {"status": "affected", "version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "lessThan": "9c0b7d61cf3c00f87f2529b5b8b785f0f65089aa", "versionType": "git"}, {"status": "affected", "version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "lessThan": "605572e64cd9cebb05ed609d96cff05b50d18cdf", "versionType": "git"}, {"status": "affected", "version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "lessThan": "b803f30ea23e0968b6c8285c42adf0d862ab2bf6", "versionType": "git"}, {"status": "affected", "version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "lessThan": "3b732449b78183d17178db40be3a4401cf3cd629", "versionType": "git"}, {"status": "affected", "version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "lessThan": "89e856e124f9ae548572c56b1b70c2255705f8fe", "versionType": "git"}], "programFiles": ["net/bluetooth/l2cap_sock.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.4"}, {"status": "unaffected", "version": "0", "lessThan": "3.4", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.271", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.222", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.101", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.42", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.11", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bluetooth/l2cap_sock.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/59a3ccd749b2550392ee531b4d727022eae4c89f"}, {"url": "https://git.kernel.org/stable/c/9c0b7d61cf3c00f87f2529b5b8b785f0f65089aa"}, {"url": "https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf"}, {"url": "https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6"}, {"url": "https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629"}, {"url": "https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbluetooth/l2cap: sync sock recv cb and release\n\nThe problem occurs between the system call to close the sock and hci_rx_work,\nwhere the former releases the sock and the latter accesses it without lock protection.\n\n CPU0 CPU1\n ---- ----\n sock_close hci_rx_work\n\t l2cap_sock_release hci_acldata_packet\n\t l2cap_sock_kill l2cap_recv_frame\n\t sk_free l2cap_conless_channel\n\t l2cap_sock_recv_cb\n\nIf hci_rx_work processes the data that needs to be received before the sock is\nclosed, then everything is normal; Otherwise, the work thread may access the\nreleased sock when receiving data.\n\nAdd a chan mutex in the rx callback of the sock to achieve synchronization between\nthe sock release and recv cb.\n\nSock is dead, so set chan data to NULL, avoid others use invalid sock pointer."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.271", "versionStartIncluding": "3.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.222", "versionStartIncluding": "3.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.101", "versionStartIncluding": "3.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.42", "versionStartIncluding": "3.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.11", "versionStartIncluding": "3.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "3.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:55:10.849Z"}}}, "cveMetadata": {"cveId": "CVE-2024-41062", "state": "PUBLISHED", "dateUpdated": "2026-10-03T10:55:10.849Z", "dateReserved": "2024-07-12T12:17:45.627Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-29T14:57:24.352Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/l2cap_sock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "59a3ccd749b2550392ee531b4d727022eae4c89f", "status": "affected", "version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "versionType": "git"}, {"lessThan": "9c0b7d61cf3c00f87f2529b5b8b785f0f65089aa", "status": "affected", "version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "versionType": "git"}, {"lessThan": "605572e64cd9cebb05ed609d96cff05b50d18cdf", "status": "affected", "version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "versionType": "git"}, {"lessThan": "b803f30ea23e0968b6c8285c42adf0d862ab2bf6", "status": "affected", "version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "versionType": "git"}, {"lessThan": "3b732449b78183d17178db40be3a4401cf3cd629", "status": "affected", "version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "versionType": "git"}, {"lessThan": "89e856e124f9ae548572c56b1b70c2255705f8fe", "status": "affected", "version": "5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/l2cap_sock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.4"}, {"lessThan": "3.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.101", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.42", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC2B5B53-6D0E-4FA7-B414-71D3FF089CAA", "versionEndExcluding": "6.1.101", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "972274A2-D688-4C37-BE42-689B58B4C225", "versionEndExcluding": "6.6.42", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "01E300B3-8B39-4A2D-8B03-4631433D3915", "versionEndExcluding": "6.9.11", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*", "matchCriteriaId": "2EBB4392-5FA6-4DA9-9772-8F9C750109FA", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*", "matchCriteriaId": "331C2F14-12C7-45D5-893D-8C52EE38EA10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*", "matchCriteriaId": "3173713D-909A-4DD3-9DD4-1E171EB057EE", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*", "matchCriteriaId": "79F18AFA-40F7-43F0-BA30-7BDB65F918B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*", "matchCriteriaId": "BD973AA4-A789-49BD-8D57-B2846935D3C7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*", "matchCriteriaId": "8F3E9E0C-AC3E-4967-AF80-6483E8AB0078", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbluetooth/l2cap: sync sock recv cb and release\n\nThe problem occurs between the system call to close the sock and hci_rx_work,\nwhere the former releases the sock and the latter accesses it without lock protection.\n\n CPU0 CPU1\n ---- ----\n sock_close hci_rx_work\n\t l2cap_sock_release hci_acldata_packet\n\t l2cap_sock_kill l2cap_recv_frame\n\t sk_free l2cap_conless_channel\n\t l2cap_sock_recv_cb\n\nIf hci_rx_work processes the data that needs to be received before the sock is\nclosed, then everything is normal; Otherwise, the work thread may access the\nreleased sock when receiving data.\n\nAdd a chan mutex in the rx callback of the sock to achieve synchronization between\nthe sock release and recv cb.\n\nSock is dead, so set chan data to NULL, avoid others use invalid sock pointer."}, {"lang": "es", "value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: bluetooth/l2cap: sync sock recv cb and release El problema ocurre entre la llamada al sistema para cerrar el calcet\u00edn y hci_rx_work, donde el primero libera el calcet\u00edn y el segundo accede a \u00e9l sin protecci\u00f3n de bloqueo. . CPU0 CPU1 ---- ---- sock_close hci_rx_work l2cap_sock_release hci_acldata_packet l2cap_sock_kill l2cap_recv_frame sk_free l2cap_conless_channel l2cap_sock_recv_cb Si hci_rx_work procesa los datos que deben recibirse antes de cerrar el sock, entonces todo es normal; De lo contrario, el hilo de trabajo puede acceder al sock liberado al recibir datos. Agregue un mutex chan en la devoluci\u00f3n de llamada rx del sock para lograr la sincronizaci\u00f3n entre la liberaci\u00f3n del sock y recv cb. Sock est\u00e1 muerto, as\u00ed que configure los datos de chan en NULL, evite que otros usen un puntero de sock no v\u00e1lido."}], "id": "CVE-2024-41062", "lastModified": "2026-10-03T11:17:30.383", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-41062", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:22:05.690775Z", "version": "2.0.3"}}]}, "published": "2024-07-29T15:15:14.173", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/59a3ccd749b2550392ee531b4d727022eae4c89f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9c0b7d61cf3c00f87f2529b5b8b785f0f65089aa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2025:6966", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:6966", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}], "bugzilla": {"description": "kernel: bluetooth/l2cap: sync sock recv cb and release", "id": "2300437", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2300437"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-413", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbluetooth/l2cap: sync sock recv cb and release\nThe problem occurs between the system call to close the sock and hci_rx_work,\nwhere the former releases the sock and the latter accesses it without lock protection.\nCPU0 CPU1\n---- ----\nsock_close hci_rx_work\nl2cap_sock_release hci_acldata_packet\nl2cap_sock_kill l2cap_recv_frame\nsk_free l2cap_conless_channel\nl2cap_sock_recv_cb\nIf hci_rx_work processes the data that needs to be received before the sock is\nclosed, then everything is normal; Otherwise, the work thread may access the\nreleased sock when receiving data.\nAdd a chan mutex in the rx callback of the sock to achieve synchronization between\nthe sock release and recv cb.\nSock is dead, so set chan data to NULL, avoid others use invalid sock pointer."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-41062", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-41062\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-41062\nhttps://lore.kernel.org/linux-cve-announce/2024072906-CVE-2024-41062-cb85@gregkh/T"], "statement": "Following issue marked as moderate with \"not affected or will not fix\" for Red Hat Enterprise Linux, as it is not vulnerable to this CVE. This is because the CVE does not impact the versions or configurations of the Linux kernel used in Red Hat's distributions.", "threat_severity": "Moderate"}

{}