CVE-2024-56757

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-56757", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T11:26:39.761Z", "datePublished": "2025-01-06T16:20:38.228Z", "dateUpdated": "2026-08-05T11:46:22.431Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:46:22.431Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: mediatek: add intf release flow when usb disconnect\n\nMediaTek claim an special usb intr interface for ISO data transmission.\nThe interface need to be released before unregistering hci device when\nusb disconnect. Removing BT usb dongle without properly releasing the\ninterface may cause Kernel panic while unregister hci device."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF is triggered by the USB disconnect/unbind path of the btusb driver, which is reachable locally without physical access via emulated USB (CONFIG_USB_RAW_GADGET/dummy_hcd, the same mechanism syzbot uses to reproduce the sibling btusb_disconnect UAFs) and via driver unbind, in addition to physical dongle removal. This matches the AV:L scoring of the directly analogous btusb disconnect-path UAFs CVE-2025-40283, CVE-2025-71082 and CVE-2025-21827.\nAC:L - No race is involved \u2014 usb_disable_device() unbinds interfaces in ascending order, so the never-released ISO interface (ifnum 2) is deterministically re-entered into btusb_disconnect() after btusb_data and hci_dev have already been freed. The attacker fully controls the device descriptors that cause the ISO interface to be claimed.\nPR:L - No capability or authorization check exists anywhere on the path; an unprivileged local user with access to an emulated-USB facility can drive probe and disconnect of a synthetic MediaTek dongle, so only basic local access is required.\nUI:N - The attacker performs the attach/detach themselves; no victim action is needed to reach the freed-object dereference.\nS:U - Both the vulnerable code and the corrupted objects (btusb_data, hci_dev with inline btmtk_data) live in the kernel's own security authority, with no crossing into a hypervisor or IOMMU boundary.\nC:H - A freed slab object is re-read (data->hdev, data->intf, data->disconnect) and freed hci_dev fields are dereferenced, so an attacker who reclaims the slab controls the contents that are read back, yielding an arbitrary-read primitive.\nI:H - The stale intf2 disconnect writes through freed pointers (usb_set_intfdata(data->intf, NULL)) and calls the freed function pointer data->disconnect, while orphaned isopkt URBs perform list_add writes into the freed hci_dev via usb_anchor_urb \u2014 a controllable write and control-flow hijack after heap spraying, compounded by the double hci_free_dev().\nA:H - The commit message itself states the bug causes a kernel panic while unregistering the hci device, and the use-after-free plus double-free reliably crashes the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btusb.c"], "versions": [{"version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "lessThan": "cc569d791ab2a0de74f76e470515d25d24c9b84b", "status": "affected", "versionType": "git"}, {"version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "lessThan": "489304e67087abddc2666c5af0159cb95afdcf59", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btusb.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.8", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cc569d791ab2a0de74f76e470515d25d24c9b84b"}, {"url": "https://git.kernel.org/stable/c/489304e67087abddc2666c5af0159cb95afdcf59"}], "title": "Bluetooth: btusb: mediatek: add intf release flow when usb disconnect", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-56757", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T19:57:05.162593Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-404", "description": "CWE-404 Improper Resource Shutdown or Release"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:07:01.318Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-56757", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T19:57:05.162593Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-404", "description": "CWE-404 Improper Resource Shutdown or Release"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T15:50:10.889Z"}}], "cna": {"title": "Bluetooth: btusb: mediatek: add intf release flow when usb disconnect", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF is triggered by the USB disconnect/unbind path of the btusb driver, which is reachable locally without physical access via emulated USB (CONFIG_USB_RAW_GADGET/dummy_hcd, the same mechanism syzbot uses to reproduce the sibling btusb_disconnect UAFs) and via driver unbind, in addition to physical dongle removal. This matches the AV:L scoring of the directly analogous btusb disconnect-path UAFs CVE-2025-40283, CVE-2025-71082 and CVE-2025-21827.\nAC:L - No race is involved \u2014 usb_disable_device() unbinds interfaces in ascending order, so the never-released ISO interface (ifnum 2) is deterministically re-entered into btusb_disconnect() after btusb_data and hci_dev have already been freed. The attacker fully controls the device descriptors that cause the ISO interface to be claimed.\nPR:L - No capability or authorization check exists anywhere on the path; an unprivileged local user with access to an emulated-USB facility can drive probe and disconnect of a synthetic MediaTek dongle, so only basic local access is required.\nUI:N - The attacker performs the attach/detach themselves; no victim action is needed to reach the freed-object dereference.\nS:U - Both the vulnerable code and the corrupted objects (btusb_data, hci_dev with inline btmtk_data) live in the kernel's own security authority, with no crossing into a hypervisor or IOMMU boundary.\nC:H - A freed slab object is re-read (data->hdev, data->intf, data->disconnect) and freed hci_dev fields are dereferenced, so an attacker who reclaims the slab controls the contents that are read back, yielding an arbitrary-read primitive.\nI:H - The stale intf2 disconnect writes through freed pointers (usb_set_intfdata(data->intf, NULL)) and calls the freed function pointer data->disconnect, while orphaned isopkt URBs perform list_add writes into the freed hci_dev via usb_anchor_urb \u2014 a controllable write and control-flow hijack after heap spraying, compounded by the double hci_free_dev().\nA:H - The commit message itself states the bug causes a kernel panic while unregistering the hci device, and the use-after-free plus double-free reliably crashes the kernel."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "lessThan": "cc569d791ab2a0de74f76e470515d25d24c9b84b", "versionType": "git"}, {"status": "affected", "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "lessThan": "489304e67087abddc2666c5af0159cb95afdcf59", "versionType": "git"}], "programFiles": ["drivers/bluetooth/btusb.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"status": "unaffected", "version": "0", "lessThan": "6.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.8", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/bluetooth/btusb.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/cc569d791ab2a0de74f76e470515d25d24c9b84b"}, {"url": "https://git.kernel.org/stable/c/489304e67087abddc2666c5af0159cb95afdcf59"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: mediatek: add intf release flow when usb disconnect\n\nMediaTek claim an special usb intr interface for ISO data transmission.\nThe interface need to be released before unregistering hci device when\nusb disconnect. Removing BT usb dongle without properly releasing the\ninterface may cause Kernel panic while unregister hci device."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.8", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13", "versionStartIncluding": "6.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:46:22.431Z"}}}, "cveMetadata": {"cveId": "CVE-2024-56757", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:46:22.431Z", "dateReserved": "2024-12-29T11:26:39.761Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-01-06T16:20:38.228Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/bluetooth/btusb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cc569d791ab2a0de74f76e470515d25d24c9b84b", "status": "affected", "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "versionType": "git"}, {"lessThan": "489304e67087abddc2666c5af0159cb95afdcf59", "status": "affected", "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/bluetooth/btusb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "37A8903F-DC48-45AD-98DC-188AFD7C5844", "versionEndExcluding": "6.12.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: mediatek: add intf release flow when usb disconnect\n\nMediaTek claim an special usb intr interface for ISO data transmission.\nThe interface need to be released before unregistering hci device when\nusb disconnect. Removing BT usb dongle without properly releasing the\ninterface may cause Kernel panic while unregister hci device."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: btusb: mediatek: agregar flujo de liberaci\u00f3n de intf cuando se desconecta el USB MediaTek reclama una interfaz USB intr especial para la transmisi\u00f3n de datos ISO. La interfaz debe liberarse antes de anular el registro del dispositivo HCI cuando se desconecta el USB. Quitar el dispositivo USB BT sin liberar correctamente la interfaz puede provocar un p\u00e1nico del kernel al anular el registro del dispositivo HCI."}], "id": "CVE-2024-56757", "lastModified": "2026-08-04T11:22:26.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-56757", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-01T19:57:05.162593Z", "version": "2.0.3"}}]}, "published": "2025-01-06T17:15:40.297", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/489304e67087abddc2666c5af0159cb95afdcf59"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc569d791ab2a0de74f76e470515d25d24c9b84b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-404"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-404"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:6966", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:6966", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}], "bugzilla": {"description": "kernel: Bluetooth: btusb: mediatek: add intf release flow when usb disconnect", "id": "2335899", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2335899"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-404", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: btusb: mediatek: add intf release flow when usb disconnect\nMediaTek claim an special usb intr interface for ISO data transmission.\nThe interface need to be released before unregistering hci device when\nusb disconnect. Removing BT usb dongle without properly releasing the\ninterface may cause Kernel panic while unregister hci device."], "name": "CVE-2024-56757", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-01-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-56757\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-56757\nhttps://lore.kernel.org/linux-cve-announce/2025010651-CVE-2024-56757-c26b@gregkh/T"], "threat_severity": "Moderate"}

{}