CVE-2024-36013 (GCVE-0-2024-36013)

Vulnerability from cvelistv5 – Published: 2024-05-23 07:03 – Updated: 2026-08-05 11:31
VLAI
Title
Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() Extend a critical section to prevent chan from early freeing. Also make the l2cap_connect() return type void. Nothing is using the returned value but it is ugly to return a potentially freed pointer. Making it void will help with backports because earlier kernels did use the return value. Now the compile will break for kernels where this patch is not a complete fix. Call stack summary: [use] l2cap_bredr_sig_cmd l2cap_connect ┌ mutex_lock(&conn->chan_lock); │ chan = pchan->ops->new_connection(pchan); <- alloc chan │ __l2cap_chan_add(conn, chan); │ l2cap_chan_hold(chan); │ list_add(&chan->list, &conn->chan_l); ... (1) └ mutex_unlock(&conn->chan_lock); chan->conf_state ... (4) <- use after free [free] l2cap_conn_del ┌ mutex_lock(&conn->chan_lock); │ foreach chan in conn->chan_l: ... (2) │ l2cap_chan_put(chan); │ l2cap_chan_destroy │ kfree(chan) ... (3) <- chan freed └ mutex_unlock(&conn->chan_lock); ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0 net/bluetooth/l2cap_core.c:4260 Read of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
6.8 (Medium)
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 73ffa904b78287f6acf8797e040150aa26a4af4a , < 8629a65a48890769c47ebc9b6e57c02a80a8975e (git)
Affected: 73ffa904b78287f6acf8797e040150aa26a4af4a , < cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5 (git)
Affected: 73ffa904b78287f6acf8797e040150aa26a4af4a , < 826af9d2f69567c646ff46d10393d47e30ad23c6 (git)
Affected: 73ffa904b78287f6acf8797e040150aa26a4af4a , < 4d7b41c0e43995b0e992b9f8903109275744b658 (git)
Create a notification for this product.
Linux Linux Affected: 3.0
Unaffected: 0 , < 3.0 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.32 , ≤ 6.6.* (semver)
Unaffected: 6.8.11 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36013",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T16:10:59.613631Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:47:42.167Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:11.584Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d47e30ad23c6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4d7b41c0e43995b0e992b9f8903109275744b658"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/30/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/30/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8629a65a48890769c47ebc9b6e57c02a80a8975e",
              "status": "affected",
              "version": "73ffa904b78287f6acf8797e040150aa26a4af4a",
              "versionType": "git"
            },
            {
              "lessThan": "cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5",
              "status": "affected",
              "version": "73ffa904b78287f6acf8797e040150aa26a4af4a",
              "versionType": "git"
            },
            {
              "lessThan": "826af9d2f69567c646ff46d10393d47e30ad23c6",
              "status": "affected",
              "version": "73ffa904b78287f6acf8797e040150aa26a4af4a",
              "versionType": "git"
            },
            {
              "lessThan": "4d7b41c0e43995b0e992b9f8903109275744b658",
              "status": "affected",
              "version": "73ffa904b78287f6acf8797e040150aa26a4af4a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.0"
            },
            {
              "lessThan": "3.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.32",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.11",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()\n\nExtend a critical section to prevent chan from early freeing.\nAlso make the l2cap_connect() return type void. Nothing is using the\nreturned value but it is ugly to return a potentially freed pointer.\nMaking it void will help with backports because earlier kernels did use\nthe return value. Now the compile will break for kernels where this\npatch is not a complete fix.\n\nCall stack summary:\n\n[use]\nl2cap_bredr_sig_cmd\n  l2cap_connect\n  \u250c mutex_lock(\u0026conn-\u003echan_lock);\n  \u2502 chan = pchan-\u003eops-\u003enew_connection(pchan); \u003c- alloc chan\n  \u2502 __l2cap_chan_add(conn, chan);\n  \u2502   l2cap_chan_hold(chan);\n  \u2502   list_add(\u0026chan-\u003elist, \u0026conn-\u003echan_l);   ... (1)\n  \u2514 mutex_unlock(\u0026conn-\u003echan_lock);\n    chan-\u003econf_state              ... (4) \u003c- use after free\n\n[free]\nl2cap_conn_del\n\u250c mutex_lock(\u0026conn-\u003echan_lock);\n\u2502 foreach chan in conn-\u003echan_l:            ... (2)\n\u2502   l2cap_chan_put(chan);\n\u2502     l2cap_chan_destroy\n\u2502       kfree(chan)               ... (3) \u003c- chan freed\n\u2514 mutex_unlock(\u0026conn-\u003echan_lock);\n\n==================================================================\nBUG: KASAN: slab-use-after-free in instrument_atomic_read\ninclude/linux/instrumented.h:68 [inline]\nBUG: KASAN: slab-use-after-free in _test_bit\ninclude/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\nBUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0\nnet/bluetooth/l2cap_core.c:4260\nRead of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable code is the BR/EDR L2CAP signalling handler, reached by an attacker-sent L2CAP_CONN_REQ over an ACL link, so the attacker must be within Bluetooth radio range of the target. Per kernel scoring guidance Bluetooth is Adjacent.\nAC:L - The attacker drives both sides of the race \u2014 it sends the L2CAP_CONN_REQ that allocates the channel and independently forces the link abort/disconnect that runs l2cap_conn_del on the other workqueue \u2014 and can repeat the attempt indefinitely at no cost. No precondition lies outside the attacker\u0027s control.\nPR:N - l2cap_bredr_sig_cmd() processes L2CAP_CONN_REQ on the fixed signalling CID 0x0001 with no authentication, and l2cap_connect() explicitly bypasses hci_conn_check_link_mode() for the always-listening SDP PSM 0x0001. An unpaired, unauthenticated remote device needs no credentials on the target.\nUI:N - Exploitation only requires the target to be connectable, which is the default state for phones, headsets, car head units, laptops and embedded devices with Bluetooth enabled. No victim action of any kind is needed.\nS:U - The corruption is of kernel slab memory handled by the kernel itself; the vulnerable component and the impacted component share the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed chan is read and its fields (imtu, max_tx, tx_win, fcs, retrans/monitor timeouts) are packed into an L2CAP Configuration Request sent back over the air, leaking reallocated slab contents directly to the attacker, and chan-\u003econn is dereferenced as a pointer taken from freed memory, giving an arbitrary-read primitive once the slab is groomed.\nI:H - After the free the code performs set_bit(CONF_REQ_SENT, \u0026chan-\u003econf_state) and chan-\u003enum_conf_req++, writing into the freed slab, and the object holds the ops function-pointer table and data/conn pointers, so heap spraying yields a write primitive and control-flow hijack potential.\nA:H - This is a slab use-after-free that reliably produces KASAN splats, memory corruption, and kernel oops/panic, and it can be re-triggered repeatedly by an unauthenticated in-range attacker to keep the system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:36.021Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8629a65a48890769c47ebc9b6e57c02a80a8975e"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d47e30ad23c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d7b41c0e43995b0e992b9f8903109275744b658"
        }
      ],
      "title": "Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36013",
    "datePublished": "2024-05-23T07:03:07.571Z",
    "dateReserved": "2024-05-17T13:50:33.153Z",
    "dateUpdated": "2026-08-05T11:31:36.021Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36013",
      "date": "2026-08-10",
      "epss": "0.0047",
      "percentile": "0.38244"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()\\n\\nExtend a critical section to prevent chan from early freeing.\\nAlso make the l2cap_connect() return type void. Nothing is using the\\nreturned value but it is ugly to return a potentially freed pointer.\\nMaking it void will help with backports because earlier kernels did use\\nthe return value. Now the compile will break for kernels where this\\npatch is not a complete fix.\\n\\nCall stack summary:\\n\\n[use]\\nl2cap_bredr_sig_cmd\\n  l2cap_connect\\n  \\u250c mutex_lock(\u0026conn-\u003echan_lock);\\n  \\u2502 chan = pchan-\u003eops-\u003enew_connection(pchan); \u003c- alloc chan\\n  \\u2502 __l2cap_chan_add(conn, chan);\\n  \\u2502   l2cap_chan_hold(chan);\\n  \\u2502   list_add(\u0026chan-\u003elist, \u0026conn-\u003echan_l);   ... (1)\\n  \\u2514 mutex_unlock(\u0026conn-\u003echan_lock);\\n    chan-\u003econf_state              ... (4) \u003c- use after free\\n\\n[free]\\nl2cap_conn_del\\n\\u250c mutex_lock(\u0026conn-\u003echan_lock);\\n\\u2502 foreach chan in conn-\u003echan_l:            ... (2)\\n\\u2502   l2cap_chan_put(chan);\\n\\u2502     l2cap_chan_destroy\\n\\u2502       kfree(chan)               ... (3) \u003c- chan freed\\n\\u2514 mutex_unlock(\u0026conn-\u003echan_lock);\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in instrument_atomic_read\\ninclude/linux/instrumented.h:68 [inline]\\nBUG: KASAN: slab-use-after-free in _test_bit\\ninclude/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\\nBUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0\\nnet/bluetooth/l2cap_core.c:4260\\nRead of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: L2CAP: corrige slab-use-after-free en l2cap_connect() Amplia una secci\\u00f3n cr\\u00edtica para evitar que chan se libere anticipadamente. Tambi\\u00e9n anule el tipo de retorno l2cap_connect(). Nada utiliza el valor devuelto, pero es feo devolver un puntero potencialmente liberado. Anularlo ayudar\\u00e1 con los backports porque los kernels anteriores usaban el valor de retorno. Ahora la compilaci\\u00f3n se interrumpir\\u00e1 en los n\\u00facleos en los que este parche no sea una soluci\\u00f3n completa. Resumen de la pila de llamadas: [usar] l2cap_bredr_sig_cmd l2cap_connect ? mutex_lock(\u0026amp;conn-\u0026gt;chan_lock); ? chan = pchan-\u0026gt;ops-\u0026gt;new_connection(pchan); \u0026lt;-alloc chan? __l2cap_chan_add(conexi\\u00f3n, chan); ? l2cap_chan_hold(chan); ? list_add(\u0026amp;chan-\u0026gt;lista, \u0026amp;conn-\u0026gt;chan_l); ... (1) ? mutex_unlock(\u0026amp;conn-\u0026gt;chan_lock); chan-\u0026gt;conf_state... (4) \u0026lt;- usar despu\\u00e9s de gratis [gratis] l2cap_conn_del? mutex_lock(\u0026amp;conn-\u0026gt;chan_lock); ? foreach chan en conn-\u0026gt;chan_l: ... (2)? l2cap_chan_put(chan); ? l2cap_chan_destroy? kfree(chan) ... (3) \u0026lt;- chan liberado? mutex_unlock(\u0026amp;conn-\u0026gt;chan_lock); ==================================================== ================ ERROR: KASAN: slab-use-after-free en instrument_atomic_read include/linux/instrumented.h:68 [en l\\u00ednea] ERROR: KASAN: slab-use-after -free en _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [en l\\u00ednea] ERROR: KASAN: slab-use-after-free en l2cap_connect+0xa67/0x11a0 net/bluetooth/l2cap_core.c:4260 Lectura del tama\\u00f1o 8 en addr ffff88810bf040a0 por tarea kworker/u3:1/311\"}]",
      "id": "CVE-2024-36013",
      "lastModified": "2024-11-21T09:21:26.040",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 6.8, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 0.9, \"impactScore\": 5.9}]}",
      "published": "2024-05-23T07:15:08.987",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/4d7b41c0e43995b0e992b9f8903109275744b658\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d47e30ad23c6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/05/30/1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/05/30/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/4d7b41c0e43995b0e992b9f8903109275744b658\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d47e30ad23c6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:56:59.000Z",
      "cve": "CVE-2024-36013",
      "id": "msrc_CVE-2024-36013",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-36013.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36013\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-23T07:15:08.987\",\"lastModified\":\"2026-08-04T11:18:22.343\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()\\n\\nExtend a critical section to prevent chan from early freeing.\\nAlso make the l2cap_connect() return type void. Nothing is using the\\nreturned value but it is ugly to return a potentially freed pointer.\\nMaking it void will help with backports because earlier kernels did use\\nthe return value. Now the compile will break for kernels where this\\npatch is not a complete fix.\\n\\nCall stack summary:\\n\\n[use]\\nl2cap_bredr_sig_cmd\\n  l2cap_connect\\n  \u250c mutex_lock(\u0026conn-\u003echan_lock);\\n  \u2502 chan = pchan-\u003eops-\u003enew_connection(pchan); \u003c- alloc chan\\n  \u2502 __l2cap_chan_add(conn, chan);\\n  \u2502   l2cap_chan_hold(chan);\\n  \u2502   list_add(\u0026chan-\u003elist, \u0026conn-\u003echan_l);   ... (1)\\n  \u2514 mutex_unlock(\u0026conn-\u003echan_lock);\\n    chan-\u003econf_state              ... (4) \u003c- use after free\\n\\n[free]\\nl2cap_conn_del\\n\u250c mutex_lock(\u0026conn-\u003echan_lock);\\n\u2502 foreach chan in conn-\u003echan_l:            ... (2)\\n\u2502   l2cap_chan_put(chan);\\n\u2502     l2cap_chan_destroy\\n\u2502       kfree(chan)               ... (3) \u003c- chan freed\\n\u2514 mutex_unlock(\u0026conn-\u003echan_lock);\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in instrument_atomic_read\\ninclude/linux/instrumented.h:68 [inline]\\nBUG: KASAN: slab-use-after-free in _test_bit\\ninclude/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\\nBUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0\\nnet/bluetooth/l2cap_core.c:4260\\nRead of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: L2CAP: corrige slab-use-after-free en l2cap_connect() Amplia una secci\u00f3n cr\u00edtica para evitar que chan se libere anticipadamente. Tambi\u00e9n anule el tipo de retorno l2cap_connect(). Nada utiliza el valor devuelto, pero es feo devolver un puntero potencialmente liberado. Anularlo ayudar\u00e1 con los backports porque los kernels anteriores usaban el valor de retorno. Ahora la compilaci\u00f3n se interrumpir\u00e1 en los n\u00facleos en los que este parche no sea una soluci\u00f3n completa. Resumen de la pila de llamadas: [usar] l2cap_bredr_sig_cmd l2cap_connect ? mutex_lock(\u0026amp;conn-\u0026gt;chan_lock); ? chan = pchan-\u0026gt;ops-\u0026gt;new_connection(pchan); \u0026lt;-alloc chan? __l2cap_chan_add(conexi\u00f3n, chan); ? l2cap_chan_hold(chan); ? list_add(\u0026amp;chan-\u0026gt;lista, \u0026amp;conn-\u0026gt;chan_l); ... (1) ? mutex_unlock(\u0026amp;conn-\u0026gt;chan_lock); chan-\u0026gt;conf_state... (4) \u0026lt;- usar despu\u00e9s de gratis [gratis] l2cap_conn_del? mutex_lock(\u0026amp;conn-\u0026gt;chan_lock); ? foreach chan en conn-\u0026gt;chan_l: ... (2)? l2cap_chan_put(chan); ? l2cap_chan_destroy? kfree(chan) ... (3) \u0026lt;- chan liberado? mutex_unlock(\u0026amp;conn-\u0026gt;chan_lock); ==================================================== ================ ERROR: KASAN: slab-use-after-free en instrument_atomic_read include/linux/instrumented.h:68 [en l\u00ednea] ERROR: KASAN: slab-use-after -free en _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [en l\u00ednea] ERROR: KASAN: slab-use-after-free en l2cap_connect+0xa67/0x11a0 net/bluetooth/l2cap_core.c:4260 Lectura del tama\u00f1o 8 en addr ffff88810bf040a0 por tarea kworker/u3:1/311\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/l2cap_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"73ffa904b78287f6acf8797e040150aa26a4af4a\",\"lessThan\":\"8629a65a48890769c47ebc9b6e57c02a80a8975e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"73ffa904b78287f6acf8797e040150aa26a4af4a\",\"lessThan\":\"cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"73ffa904b78287f6acf8797e040150aa26a4af4a\",\"lessThan\":\"826af9d2f69567c646ff46d10393d47e30ad23c6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"73ffa904b78287f6acf8797e040150aa26a4af4a\",\"lessThan\":\"4d7b41c0e43995b0e992b9f8903109275744b658\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/l2cap_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.32\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.11\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":6.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-23T16:10:59.613631Z\",\"id\":\"CVE-2024-36013\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"6.6.32\",\"matchCriteriaId\":\"6908BAC6-611E-42B7-BC6C-B43E6BCA57B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.11\",\"matchCriteriaId\":\"3B75CBAF-FD3C-40AE-85BB-0525E142C4C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"F850DCEC-E08B-4317-A33B-D2DCF39F601B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"91326417-E981-482E-A5A3-28BC1327521B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"DAECDCD8-F556-4606-8D7B-5C6D47A501F2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4d7b41c0e43995b0e992b9f8903109275744b658\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d47e30ad23c6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8629a65a48890769c47ebc9b6e57c02a80a8975e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/05/30/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/05/30/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://git.kernel.org/stable/c/4d7b41c0e43995b0e992b9f8903109275744b658\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d47e30ad23c6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:57:35+00:00",
      "cve": "CVE-2024-36013",
      "id": "CVE-2024-36013",
      "initial_release_date": "2024-05-23T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36013.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:49:07Z",
      "cve": "CVE-2024-36013",
      "id": "CVE-2024-36013",
      "initial_release_date": "2024-06-04T12:15:32Z",
      "product_status:known_affected": "546",
      "product_status:recommended": "773",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-36013",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-36013.json",
      "version": "91"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d47e30ad23c6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4d7b41c0e43995b0e992b9f8903109275744b658\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/05/30/2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/05/30/1\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:30:11.584Z\"}}, {\"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.8, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36013\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-23T16:10:59.613631Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T16:13:08.964Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The vulnerable code is the BR/EDR L2CAP signalling handler, reached by an attacker-sent L2CAP_CONN_REQ over an ACL link, so the attacker must be within Bluetooth radio range of the target. Per kernel scoring guidance Bluetooth is Adjacent.\\nAC:L - The attacker drives both sides of the race \\u2014 it sends the L2CAP_CONN_REQ that allocates the channel and independently forces the link abort/disconnect that runs l2cap_conn_del on the other workqueue \\u2014 and can repeat the attempt indefinitely at no cost. No precondition lies outside the attacker\u0027s control.\\nPR:N - l2cap_bredr_sig_cmd() processes L2CAP_CONN_REQ on the fixed signalling CID 0x0001 with no authentication, and l2cap_connect() explicitly bypasses hci_conn_check_link_mode() for the always-listening SDP PSM 0x0001. An unpaired, unauthenticated remote device needs no credentials on the target.\\nUI:N - Exploitation only requires the target to be connectable, which is the default state for phones, headsets, car head units, laptops and embedded devices with Bluetooth enabled. No victim action of any kind is needed.\\nS:U - The corruption is of kernel slab memory handled by the kernel itself; the vulnerable component and the impacted component share the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The freed chan is read and its fields (imtu, max_tx, tx_win, fcs, retrans/monitor timeouts) are packed into an L2CAP Configuration Request sent back over the air, leaking reallocated slab contents directly to the attacker, and chan-\u003econn is dereferenced as a pointer taken from freed memory, giving an arbitrary-read primitive once the slab is groomed.\\nI:H - After the free the code performs set_bit(CONF_REQ_SENT, \u0026chan-\u003econf_state) and chan-\u003enum_conf_req++, writing into the freed slab, and the object holds the ops function-pointer table and data/conn pointers, so heap spraying yields a write primitive and control-flow hijack potential.\\nA:H - This is a slab use-after-free that reliably produces KASAN splats, memory corruption, and kernel oops/panic, and it can be re-triggered repeatedly by an unauthenticated in-range attacker to keep the system down.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"73ffa904b78287f6acf8797e040150aa26a4af4a\", \"lessThan\": \"8629a65a48890769c47ebc9b6e57c02a80a8975e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73ffa904b78287f6acf8797e040150aa26a4af4a\", \"lessThan\": \"cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73ffa904b78287f6acf8797e040150aa26a4af4a\", \"lessThan\": \"826af9d2f69567c646ff46d10393d47e30ad23c6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73ffa904b78287f6acf8797e040150aa26a4af4a\", \"lessThan\": \"4d7b41c0e43995b0e992b9f8903109275744b658\", \"versionType\": \"git\"}], \"programFiles\": [\"net/bluetooth/l2cap_core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.178\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.32\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/bluetooth/l2cap_core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8629a65a48890769c47ebc9b6e57c02a80a8975e\"}, {\"url\": \"https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5\"}, {\"url\": \"https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d47e30ad23c6\"}, {\"url\": \"https://git.kernel.org/stable/c/4d7b41c0e43995b0e992b9f8903109275744b658\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()\\n\\nExtend a critical section to prevent chan from early freeing.\\nAlso make the l2cap_connect() return type void. Nothing is using the\\nreturned value but it is ugly to return a potentially freed pointer.\\nMaking it void will help with backports because earlier kernels did use\\nthe return value. Now the compile will break for kernels where this\\npatch is not a complete fix.\\n\\nCall stack summary:\\n\\n[use]\\nl2cap_bredr_sig_cmd\\n  l2cap_connect\\n  \\u250c mutex_lock(\u0026conn-\u003echan_lock);\\n  \\u2502 chan = pchan-\u003eops-\u003enew_connection(pchan); \u003c- alloc chan\\n  \\u2502 __l2cap_chan_add(conn, chan);\\n  \\u2502   l2cap_chan_hold(chan);\\n  \\u2502   list_add(\u0026chan-\u003elist, \u0026conn-\u003echan_l);   ... (1)\\n  \\u2514 mutex_unlock(\u0026conn-\u003echan_lock);\\n    chan-\u003econf_state              ... (4) \u003c- use after free\\n\\n[free]\\nl2cap_conn_del\\n\\u250c mutex_lock(\u0026conn-\u003echan_lock);\\n\\u2502 foreach chan in conn-\u003echan_l:            ... (2)\\n\\u2502   l2cap_chan_put(chan);\\n\\u2502     l2cap_chan_destroy\\n\\u2502       kfree(chan)               ... (3) \u003c- chan freed\\n\\u2514 mutex_unlock(\u0026conn-\u003echan_lock);\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in instrument_atomic_read\\ninclude/linux/instrumented.h:68 [inline]\\nBUG: KASAN: slab-use-after-free in _test_bit\\ninclude/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\\nBUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0\\nnet/bluetooth/l2cap_core.c:4260\\nRead of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.178\", \"versionStartIncluding\": \"3.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.32\", \"versionStartIncluding\": \"3.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.11\", \"versionStartIncluding\": \"3.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"3.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:36.021Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36013\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:36.021Z\", \"dateReserved\": \"2024-05-17T13:50:33.153Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-23T07:03:07.571Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.