In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
There is a race condition between l2cap_chan_timeout() and l2cap_chan_del(). When we use l2cap_chan_del() to delete the channel, the chan->conn will be set to null. But the conn could be dereferenced again in the mutex_lock() of l2cap_chan_timeout(). As a result the null pointer dereference bug will happen. The KASAN report triggered by POC is shown below:
[ 472.074580] ================================================================== [ 472.075284] BUG: KASAN: null-ptr-deref in mutex_lock+0x68/0xc0 [ 472.075308] Write of size 8 at addr 0000000000000158 by task kworker/0:0/7 [ 472.075308] [ 472.075308] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.075308] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.075308] Workqueue: events l2cap_chan_timeout [ 472.075308] Call Trace: [ 472.075308] <TASK> [ 472.075308] dump_stack_lvl+0x137/0x1a0 [ 472.075308] print_report+0x101/0x250 [ 472.075308] ? __virt_addr_valid+0x77/0x160 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_report+0x139/0x170 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_check_range+0x2c3/0x2e0 [ 472.075308] mutex_lock+0x68/0xc0 [ 472.075308] l2cap_chan_timeout+0x181/0x300 [ 472.075308] process_one_work+0x5d2/0xe00 [ 472.075308] worker_thread+0xe1d/0x1660 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] kthread+0x2b7/0x350 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork+0x4d/0x80 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork_asm+0x11/0x20 [ 472.075308] </TASK> [ 472.075308] ================================================================== [ 472.094860] Disabling lock debugging due to kernel taint [ 472.096136] BUG: kernel NULL pointer dereference, address: 0000000000000158 [ 472.096136] #PF: supervisor write access in kernel mode [ 472.096136] #PF: error_code(0x0002) - not-present page [ 472.096136] PGD 0 P4D 0 [ 472.096136] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI [ 472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 Tainted: G B 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.096136] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.096136] Workqueue: events l2cap_chan_timeout [ 472.096136] RIP: 0010:mutex_lock+0x88/0xc0 [ 472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88 [ 472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246 [ 472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865 [ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78 [ 472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f [ 472.096136] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000 [ 472.096136] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00 [ 472.096136] FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000 [ 472.096136] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.096136] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0 [ 472.096136] Call Trace: [ 472.096136] <TASK> [ 472.096136] ? __die_body+0x8d/0xe0 [ 472.096136] ? page_fault_oops+0x6b8/0x9a0 [ 472.096136] ? kernelmode_fixup_or_oops+0x20c/0x2a0 [ 472.096136] ? do_user_addr_fault+0x1027/0x1340 [ 472.096136] ? _printk+0x7a/0xa0 [ 472.096136] ? mutex_lock+0x68/0xc0 [ 472.096136] ? add_taint+0x42/0xd0 [ 472.096136] ? exc_page_fault+0x6a/0x1b0 [ 472.096136] ? asm_exc_page_fault+0x26/0x30 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] ? mutex_lock+0x88/0xc0 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] l2cap_chan_timeo ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-zfcpdump-modulesUpgrade kernel-tools-libs-develUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-debug-coreUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-devel-matchedUpgrade perfUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debugUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-64k-debug-coreUpgrade kernel-64k-devel-matchedUpgrade rvUpgrade kernel-64k-debug-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-modules-extraUpgrade bpftoolUpgrade kernel-zfcpdump-coreUpgrade kernel-rtUpgrade kernel-abi-stablelistsUpgrade kernel-64k-modules-extraUpgrade kernel-toolsUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-develUpgrade kernel-rt-coreUpgrade kernel-debug-modules-coreUpgrade kernel-modulesUpgrade kernelUpgrade kernel-debug-coreUpgrade kernel-64kUpgrade kernel-64k-develUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-develUpgrade kernel-64k-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-uki-virtUpgrade kernel-debug-develUpgrade kernel-debugUpgrade kernel-64k-debug-modules-extraUpgrade kernel-docUpgrade rtlaUpgrade kernel-coreUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modules-coreUpgrade kernel-rt-debug-modulesUpgrade python3-perfUpgrade kernel-modules-extraUpgrade kernel-cross-headersUpgrade kernel-rt-debug-modules-extraUpgrade kernel-headersUpgrade kernel-64k-debug-develUpgrade kernel-develUpgrade libperfUpgrade kernel-64k-modulesUpgrade kernel-64k-coreUpgrade kernel-zfcpdump | Dec 4, 2024 | May 14, 2024 |
| Debian | — | Upgrade linux | Jun 4, 2024 | May 14, 2024 |
| Oracle_linux | — | Upgrade kernel | Nov 27, 2024 | May 13, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Sep 25, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade perf-debuginfoUpgrade perfUpgrade kernel-debug-modules-extraUpgrade python3-perfUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-debugUpgrade kernel-coreUpgrade kernel-tools-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-debug-coreUpgrade bpftool-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-cross-headersUpgrade kernel-debuginfoUpgrade kernel-debug-develUpgrade kernel-debug-debuginfoUpgrade kernel-tools-libsUpgrade kernel-modules-extraUpgrade kernelUpgrade bpftoolUpgrade kernel-develUpgrade kernel-modulesUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64 | Feb 5, 2026 | Dec 19, 2024 |
| Suse | — | Upgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-rt-develUpgrade kernel-syms-rtUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-rtUpgrade kernel-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-default-manUpgrade dlm-kmp-azureUpgrade dlm-kmp-defaultUpgrade kernel-kvmsmallUpgrade dtb-apmUpgrade kernel-devel-rtUpgrade dtb-socionextUpgrade dtb-sprdUpgrade dtb-mediatekUpgrade dtb-renesasUpgrade kernel-default-extraUpgrade kernel-docsUpgrade kernel-symsUpgrade dtb-amlogicUpgrade kernel-rt_debugUpgrade kernel-rt_debug-vdsoUpgrade dtb-rockchipUpgrade dtb-armUpgrade kernel-macrosUpgrade kernel-obs-qaUpgrade kernel-64kb-extraUpgrade kernel-64kb-develUpgrade dtb-amdUpgrade dtb-nvidiaUpgrade kernel-debug-livepatch-develUpgrade kernel-default-base-rebuildUpgrade cluster-md-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-debug-develUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kernel-azure-vdsoUpgrade dtb-marvellUpgrade kernel-default-develUpgrade dtb-qcomUpgrade kernel-source-azureUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-docs-htmlUpgrade kernel-default-livepatchUpgrade dtb-alteraUpgrade kernel-develUpgrade kselftests-kmp-azureUpgrade dtb-hisiliconUpgrade dtb-exynosUpgrade gfs2-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade kernel-syms-azureUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-defaultUpgrade kernel-azure-optionalUpgrade kernel-default-vdsoUpgrade kernel-default-optionalUpgrade kernel-azureUpgrade dtb-xilinxUpgrade kernel-rtUpgrade dtb-caviumUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-64kbUpgrade kernel-devel-azureUpgrade kernel-obs-buildUpgrade kernel-azure-livepatch-develUpgrade kernel-debugUpgrade kernel-64kbUpgrade gfs2-kmp-azureUpgrade dtb-amazonUpgrade kernel-kvmsmall-vdsoUpgrade dtb-broadcomUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-optionalUpgrade kernel-azure-extraUpgrade dtb-freescaleUpgrade kernel-azure-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-zfcpdumpUpgrade kernel-sourceUpgrade dtb-allwinnerUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade dtb-appleUpgrade dtb-lgUpgrade kernel-debug-vdsoUpgrade ocfs2-kmp-azureUpgrade kernel-azure-baseUpgrade cluster-md-kmp-rtUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-azureUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-rt-vdso | Jun 13, 2024 | May 14, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-118-generic-lpaeUpgrade linux-image-5.4.0-192-genericUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1062-intel-iotgUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-5.4.0-1077-ibmUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-5.15.0-1050-gkeopUpgrade linux-image-5.15.0-1062-nvidiaUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-118-genericUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-6.8.0-1010-oemUpgrade linux-image-oracle-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-kvmUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-5.4.0-1097-gkeopUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-5.15.0-1066-gcpUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1064-kvmUpgrade linux-image-5.4.0-1049-xilinx-zynqmpUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oracleUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-oem-20.04dUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.15.0-1070-azure-fdeUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-raspi-nolpaeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.15.0-1062-nvidia-lowlatencyUpgrade linux-image-5.15.0-1065-oracleUpgrade linux-image-oem-24.04aUpgrade linux-image-5.15.0-1067-awsUpgrade linux-image-5.15.0-118-lowlatencyUpgrade linux-image-gkeop-5.15Upgrade linux-image-virtualUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.4.0-1130-awsUpgrade linux-image-5.15.0-118-generic-64kUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-awsUpgrade linux-image-5.4.0-1129-oracleUpgrade linux-image-oem-20.04Upgrade linux-image-azure-cvmUpgrade linux-image-bluefieldUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-5.4.0-1090-bluefieldUpgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-intelUpgrade linux-image-generic-lpaeUpgrade linux-image-5.4.0-1135-azureUpgrade linux-image-gke-5.15Upgrade linux-image-5.4.0-1114-raspiUpgrade linux-image-azureUpgrade linux-image-5.4.0-1118-kvmUpgrade linux-image-oem-24.04Upgrade linux-image-intel-iotgUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-gkeop-5.4Upgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-1013-awsUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-5.4.0-1042-iotUpgrade linux-image-5.15.0-118-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-azure-lts-20.04Upgrade linux-image-5.4.0-192-lowlatencyUpgrade linux-image-oem-20.04cUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-5.4.0-192-generic-lpaeUpgrade linux-image-genericUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-1060-ibmUpgrade linux-image-5.15.0-1064-gkeUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-azure-lts-22.04Upgrade linux-image-azure-fdeUpgrade linux-image-ibm-classicUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-oemUpgrade linux-image-5.15.0-1070-azureUpgrade linux-image-raspiUpgrade linux-image-raspi2Upgrade linux-image-aws-lts-20.04Upgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-5.4.0-1134-gcpUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1060-raspiUpgrade linux-image-oem-osp1Upgrade linux-image-ibmUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-gkeop | Aug 9, 2024 | May 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 13, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub