CVE-2024-26886

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-26886
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26886.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-26886
Downstream
Related
Published
2024-04-17T10:27:40.941Z
Modified
2025-11-28T02:35:21.931019Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Bluetooth: af_bluetooth: Fix deadlock
Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: af_bluetooth: Fix deadlock

Attemting to do socklock on .recvmsg may cause a deadlock as shown bellow, so instead of using socksock this uses skreceivequeue.lock on btsockioctl to avoid the UAF:

INFO: task kworker/u9:1:121 blocked for more than 30 seconds. Not tainted 6.7.6-lemon #183 Workqueue: hci0 hcirxwork Call Trace: <TASK> _schedule+0x37d/0xa00 schedule+0x32/0xe0 _locksock+0x68/0xa0 ? _pfxautoremovewakefunction+0x10/0x10 locksocknested+0x43/0x50 l2capsockrecvcb+0x21/0xa0 l2caprecvframe+0x55b/0x30a0 ? psitaskswitch+0xeb/0x270 ? finishtaskswitch.isra.0+0x93/0x2a0 hcirxwork+0x33a/0x3f0 processonework+0x13a/0x2f0 workerthread+0x2f0/0x410 ? _pfxworkerthread+0x10/0x10 kthread+0xe0/0x110 ? _pfxkthread+0x10/0x10 retfromfork+0x2c/0x50 ? _pfxkthread+0x10/0x10 retfromfork_asm+0x1b/0x30 </TASK>

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26886.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1d576c3a5af850bf11fbd103f9ba11aa6d6061fb
Fixed
64be3c6154886200708da0dfe259705fb992416c
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
2e07e8348ea454615e268222ae3fc240421be768
Fixed
817e8138ce86001b2fa5c63d6ede756e205a01f7
Fixed
2c9e2df022ef8b9d7fac58a04a2ef4ed25288955
Fixed
f7b94bdc1ec107c92262716b073b3e816d4784fb
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
db1b14eec8c61a20374de9f9c2ddc6c9406a8c42
Last affected
2b16d960c79abc397f102c3d23d30005b68cb036
Last affected
37f71e2c9f515834841826f4eb68ec33cfb2a1ff

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.6.23
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.7.11
Fixed
6.8.2