CVE-2024-36013Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
- 8.8HighCVSS base score
- 0.48%Exploitation in 30 daysEPSS · top 58% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() Extend a critical section to prevent chan from early freeing. Also make the l2cap_connect() return type void. Nothing is using the returned value but it is ugly to return a potentially freed pointer. Making it void will help with backports because earlier kernels did use the return value. Now the compile will break for kernels where this patch is not a complete fix. Call stack summary: [use] l2cap_bredr_sig_cmd l2cap_connect ┌ mutex_lock(&conn->chan_lock); │ chan = pchan->ops->new_connection(pchan); <- alloc chan │ __l2cap_chan_add(conn, chan); │ l2cap_chan_hold(chan); │ list_add(&chan->list, &conn->chan_l); ... (1) └ mutex_unlock(&conn->chan_lock); chan->conf_state ... (4) <- use after free [free] l2cap_conn_del ┌ mutex_lock(&conn->chan_lock); │ foreach chan in conn->chan_l: ... (2) │ l2cap_chan_put(chan); │ l2cap_chan_destroy │ kfree(chan) ... (3) <- chan freed └ mutex_unlock(&conn->chan_lock); ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0 net/bluetooth/l2cap_core.c:4260 Read of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 2 years later
· 2 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CISA-ADPADP (enrichment) | 3.1 | Medium6.8 | CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.48% · top 58% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Affected products
- affected 73ffa904b78287f6acf8797e040150aa26a4af4a – < 8629a65a48890769c47ebc9b6e57c02a80a8975e
- affected 73ffa904b78287f6acf8797e040150aa26a4af4a – < cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5
- affected 73ffa904b78287f6acf8797e040150aa26a4af4a – < 826af9d2f69567c646ff46d10393d47e30ad23c6
- affected 73ffa904b78287f6acf8797e040150aa26a4af4a – < 4d7b41c0e43995b0e992b9f8903109275744b658
- affected 3.0
- unaffected < 3.0
- unaffected 6.1.178 – ≤ 6.1.*
- unaffected 6.6.32 – ≤ 6.6.*
- unaffected 6.8.11 – ≤ 6.8.*
- unaffected 6.9 – ≤ *
References
References6
- https://git.kernel.org/stable/c/8629a65a48890769c47ebc9b6e57c02a80a8975e (opens in a new tab)
- https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d47e30ad23c6 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/4d7b41c0e43995b0e992b9f8903109275744b658 (opens in a new tab)x_transferred
- http://www.openwall.com/lists/oss-security/2024/05/30/2 (opens in a new tab)x_transferred
- http://www.openwall.com/lists/oss-security/2024/05/30/1 (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-35823 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-36013)Record last updated .