CVE-2024-26890 (GCVE-0-2024-26890)
Vulnerability from cvelistv5
Published
2024-04-17 10:27
Modified
2026-08-05 11:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btrtl: fix out of bounds memory access
The problem is detected by KASAN.
btrtl driver uses private hci data to store 'struct btrealtek_data'.
If btrtl driver is used with btusb, then memory for private hci data
is allocated in btusb. But no private data is allocated after hci_dev,
when btrtl is used with hci_h5.
This commit adds memory allocation for hci_h5 case.
==================================================================
BUG: KASAN: slab-out-of-bounds in btrtl_initialize+0x6cc/0x958 [btrtl]
Write of size 8 at addr ffff00000f5a5748 by task kworker/u9:0/76
Hardware name: Pine64 PinePhone (1.2) (DT)
Workqueue: hci0 hci_power_on [bluetooth]
Call trace:
dump_backtrace+0x9c/0x128
show_stack+0x20/0x38
dump_stack_lvl+0x48/0x60
print_report+0xf8/0x5d8
kasan_report+0x90/0xd0
__asan_store8+0x9c/0xc0
[btrtl]
h5_btrtl_setup+0xd0/0x2f8 [hci_uart]
h5_setup+0x50/0x80 [hci_uart]
hci_uart_setup+0xd4/0x260 [hci_uart]
hci_dev_open_sync+0x1cc/0xf68 [bluetooth]
hci_dev_do_open+0x34/0x90 [bluetooth]
hci_power_on+0xc4/0x3c8 [bluetooth]
process_one_work+0x328/0x6f0
worker_thread+0x410/0x778
kthread+0x168/0x178
ret_from_fork+0x10/0x20
Allocated by task 53:
kasan_save_stack+0x3c/0x68
kasan_save_track+0x20/0x40
kasan_save_alloc_info+0x68/0x78
__kasan_kmalloc+0xd4/0xd8
__kmalloc+0x1b4/0x3b0
hci_alloc_dev_priv+0x28/0xa58 [bluetooth]
hci_uart_register_device+0x118/0x4f8 [hci_uart]
h5_serdev_probe+0xf4/0x178 [hci_uart]
serdev_drv_probe+0x54/0xa0
really_probe+0x254/0x588
__driver_probe_device+0xc4/0x210
driver_probe_device+0x64/0x160
__driver_attach_async_helper+0x88/0x158
async_run_entry_fn+0xd0/0x388
process_one_work+0x328/0x6f0
worker_thread+0x410/0x778
kthread+0x168/0x178
ret_from_fork+0x10/0x20
Last potentially related work creation:
kasan_save_stack+0x3c/0x68
__kasan_record_aux_stack+0xb0/0x150
kasan_record_aux_stack_noalloc+0x14/0x20
__queue_work+0x33c/0x960
queue_work_on+0x98/0xc0
hci_recv_frame+0xc8/0x1e8 [bluetooth]
h5_complete_rx_pkt+0x2c8/0x800 [hci_uart]
h5_rx_payload+0x98/0xb8 [hci_uart]
h5_recv+0x158/0x3d8 [hci_uart]
hci_uart_receive_buf+0xa0/0xe8 [hci_uart]
ttyport_receive_buf+0xac/0x178
flush_to_ldisc+0x130/0x2c8
process_one_work+0x328/0x6f0
worker_thread+0x410/0x778
kthread+0x168/0x178
ret_from_fork+0x10/0x20
Second to last potentially related work creation:
kasan_save_stack+0x3c/0x68
__kasan_record_aux_stack+0xb0/0x150
kasan_record_aux_stack_noalloc+0x14/0x20
__queue_work+0x788/0x960
queue_work_on+0x98/0xc0
__hci_cmd_sync_sk+0x23c/0x7a0 [bluetooth]
__hci_cmd_sync+0x24/0x38 [bluetooth]
btrtl_initialize+0x760/0x958 [btrtl]
h5_btrtl_setup+0xd0/0x2f8 [hci_uart]
h5_setup+0x50/0x80 [hci_uart]
hci_uart_setup+0xd4/0x260 [hci_uart]
hci_dev_open_sync+0x1cc/0xf68 [bluetooth]
hci_dev_do_open+0x34/0x90 [bluetooth]
hci_power_on+0xc4/0x3c8 [bluetooth]
process_one_work+0x328/0x6f0
worker_thread+0x410/0x778
kthread+0x168/0x178
ret_from_fork+0x10/0x20
==================================================================
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-26890",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-16T15:26:42.807885Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T15:19:10.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:21:05.409Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/dd163fa34c483f1674aa2510accce11a224f649e"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/2f232bc389a4f5943c40733582f9edf77b89e499"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/0c657e641df1e77d6087688190f632cad9c0439b"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/de4e88ec58c4202efd1f02eebb4939bbf6945358"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/hci_h5.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dd163fa34c483f1674aa2510accce11a224f649e",
"status": "affected",
"version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
"versionType": "git"
},
{
"lessThan": "2f232bc389a4f5943c40733582f9edf77b89e499",
"status": "affected",
"version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
"versionType": "git"
},
{
"lessThan": "0c657e641df1e77d6087688190f632cad9c0439b",
"status": "affected",
"version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
"versionType": "git"
},
{
"lessThan": "de4e88ec58c4202efd1f02eebb4939bbf6945358",
"status": "affected",
"version": "5b355944b19011011dd3fd4187444c5ff1d76ad2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/hci_h5.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.7.*",
"status": "unaffected",
"version": "6.7.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"version": "6.8.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.23",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.11",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.2",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: fix out of bounds memory access\n\nThe problem is detected by KASAN.\nbtrtl driver uses private hci data to store \u0027struct btrealtek_data\u0027.\nIf btrtl driver is used with btusb, then memory for private hci data\nis allocated in btusb. But no private data is allocated after hci_dev,\nwhen btrtl is used with hci_h5.\n\nThis commit adds memory allocation for hci_h5 case.\n\n ==================================================================\n BUG: KASAN: slab-out-of-bounds in btrtl_initialize+0x6cc/0x958 [btrtl]\n Write of size 8 at addr ffff00000f5a5748 by task kworker/u9:0/76\n\n Hardware name: Pine64 PinePhone (1.2) (DT)\n Workqueue: hci0 hci_power_on [bluetooth]\n Call trace:\n dump_backtrace+0x9c/0x128\n show_stack+0x20/0x38\n dump_stack_lvl+0x48/0x60\n print_report+0xf8/0x5d8\n kasan_report+0x90/0xd0\n __asan_store8+0x9c/0xc0\n \t [btrtl]\n h5_btrtl_setup+0xd0/0x2f8 [hci_uart]\n h5_setup+0x50/0x80 [hci_uart]\n hci_uart_setup+0xd4/0x260 [hci_uart]\n hci_dev_open_sync+0x1cc/0xf68 [bluetooth]\n hci_dev_do_open+0x34/0x90 [bluetooth]\n hci_power_on+0xc4/0x3c8 [bluetooth]\n process_one_work+0x328/0x6f0\n worker_thread+0x410/0x778\n kthread+0x168/0x178\n ret_from_fork+0x10/0x20\n\n Allocated by task 53:\n kasan_save_stack+0x3c/0x68\n kasan_save_track+0x20/0x40\n kasan_save_alloc_info+0x68/0x78\n __kasan_kmalloc+0xd4/0xd8\n __kmalloc+0x1b4/0x3b0\n hci_alloc_dev_priv+0x28/0xa58 [bluetooth]\n hci_uart_register_device+0x118/0x4f8 [hci_uart]\n h5_serdev_probe+0xf4/0x178 [hci_uart]\n serdev_drv_probe+0x54/0xa0\n really_probe+0x254/0x588\n __driver_probe_device+0xc4/0x210\n driver_probe_device+0x64/0x160\n __driver_attach_async_helper+0x88/0x158\n async_run_entry_fn+0xd0/0x388\n process_one_work+0x328/0x6f0\n worker_thread+0x410/0x778\n kthread+0x168/0x178\n ret_from_fork+0x10/0x20\n\n Last potentially related work creation:\n kasan_save_stack+0x3c/0x68\n __kasan_record_aux_stack+0xb0/0x150\n kasan_record_aux_stack_noalloc+0x14/0x20\n __queue_work+0x33c/0x960\n queue_work_on+0x98/0xc0\n hci_recv_frame+0xc8/0x1e8 [bluetooth]\n h5_complete_rx_pkt+0x2c8/0x800 [hci_uart]\n h5_rx_payload+0x98/0xb8 [hci_uart]\n h5_recv+0x158/0x3d8 [hci_uart]\n hci_uart_receive_buf+0xa0/0xe8 [hci_uart]\n ttyport_receive_buf+0xac/0x178\n flush_to_ldisc+0x130/0x2c8\n process_one_work+0x328/0x6f0\n worker_thread+0x410/0x778\n kthread+0x168/0x178\n ret_from_fork+0x10/0x20\n\n Second to last potentially related work creation:\n kasan_save_stack+0x3c/0x68\n __kasan_record_aux_stack+0xb0/0x150\n kasan_record_aux_stack_noalloc+0x14/0x20\n __queue_work+0x788/0x960\n queue_work_on+0x98/0xc0\n __hci_cmd_sync_sk+0x23c/0x7a0 [bluetooth]\n __hci_cmd_sync+0x24/0x38 [bluetooth]\n btrtl_initialize+0x760/0x958 [btrtl]\n h5_btrtl_setup+0xd0/0x2f8 [hci_uart]\n h5_setup+0x50/0x80 [hci_uart]\n hci_uart_setup+0xd4/0x260 [hci_uart]\n hci_dev_open_sync+0x1cc/0xf68 [bluetooth]\n hci_dev_do_open+0x34/0x90 [bluetooth]\n hci_power_on+0xc4/0x3c8 [bluetooth]\n process_one_work+0x328/0x6f0\n worker_thread+0x410/0x778\n kthread+0x168/0x178\n ret_from_fork+0x10/0x20\n =================================================================="
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The out-of-bounds access happens in the HCI device setup path (`h5_serdev_probe` \u2192 `hci_dev_open_sync` \u2192 `h5_btrtl_setup` \u2192 `btrtl_initialize`), driven entirely by local driver probe/open and locally loaded firmware, before any RF link exists. No network or adjacent-network data reaches the vulnerable code, and the UART-attached controller is a permanently soldered on-board device rather than a hot-plugged one.\nAC:L - The overflow is unconditional and fully deterministic \u2014 `sizeof_priv` is zero for every RTL H5 device, so every single `btrtl_initialize()`/`btrtl_download_firmware()` run writes past the end of the `hci_dev` allocation with no race, no timing window, and no memory grooming required. It reproduces on the first attempt on every affected system, as the reported KASAN splat from a stock PinePhone boot shows.\nPR:L - An unprivileged local session user on the affected phone/tablet/laptop class can re-trigger the write at will, because `h5_btrtl_resume()` performs a `device_reprobe()` on RTL8723BS parts and a suspend/resume cycle is permitted to active local sessions by default logind/polkit policy, re-running the full setup path. The write also fires with zero privileges during the automatic boot-time probe; the root/`CAP_NET_ADMIN`-gated `HCIDEVUP` ioctl is only one of several trigger routes, not a required one.\nUI:N - The out-of-bounds write executes in a kernel workqueue during automatic device probe and power-on, with no administrator or victim action of any kind. The suspend/resume re-trigger is initiated by the attacker\u0027s own process.\nS:U - The corruption is confined to the kernel slab of the same host and is exploited by, and against, the kernel\u0027s own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `btrtl_dmp_hdr()` reads the out-of-bounds `rtl_dump.controller` and `rtl_dump.driver_name` fields back as pointers and `snprintf(\"%s\", ...)`s them into a devcoredump buffer that userspace can read from `/sys/class/devcoredump/`; when that region overlaps a neighbouring slab object whose contents have since changed, this becomes a read of an attacker-influenceable kernel pointer and disclosure of arbitrary kernel memory. The out-of-bounds region also exposes adjacent heap contents to the driver\u0027s own logic (`btrealtek_test_flag`, firmware-version reporting).\nI:H - This is a confirmed slab out-of-bounds write (KASAN \"Write of size 8\") of up to 32 bytes \u2014 two kernel `.rodata` pointers, a firmware-derived `u32`, and a `set_bit()` \u2014 immediately past the `hci_dev` allocation, at a fixed and predictable offset. Depending on kernel version, architecture, and config (`sizeof(struct hci_dev)` relative to the kmalloc bucket, particularly on the 32-bit ARM boards that use this exact driver), those bytes land in the head of the adjacent heap object, giving a repeatable heap-overflow primitive that can be groomed by controlling what occupies the neighbouring slot.\nA:H - Corrupting the first bytes of a neighbouring kmalloc object, and later dereferencing pointers read back out of bounds in `btrtl_dmp_hdr()`, readily produces a kernel oops or panic; the access is repeated on every probe, resume, and device open. On builds with KASAN or arm64 MTE (shipped in production on some Android devices), the very first occurrence is a fatal report/panic, and `panic_on_warn`/`panic_on_oops` hardened embedded and automotive builds turn it into an immediate full system outage."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:28:11.662Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dd163fa34c483f1674aa2510accce11a224f649e"
},
{
"url": "https://git.kernel.org/stable/c/2f232bc389a4f5943c40733582f9edf77b89e499"
},
{
"url": "https://git.kernel.org/stable/c/0c657e641df1e77d6087688190f632cad9c0439b"
},
{
"url": "https://git.kernel.org/stable/c/de4e88ec58c4202efd1f02eebb4939bbf6945358"
}
],
"title": "Bluetooth: btrtl: fix out of bounds memory access",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-26890",
"datePublished": "2024-04-17T10:27:43.438Z",
"dateReserved": "2024-02-19T14:20:24.186Z",
"dateUpdated": "2026-08-05T11:28:11.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/dd163fa34c483f1674aa2510accce11a224f649e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2f232bc389a4f5943c40733582f9edf77b89e499\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0c657e641df1e77d6087688190f632cad9c0439b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/de4e88ec58c4202efd1f02eebb4939bbf6945358\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:21:05.409Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26890\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-16T15:26:42.807885Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-16T15:26:53.419Z\"}}], \"cna\": {\"title\": \"Bluetooth: btrtl: fix out of bounds memory access\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The out-of-bounds access happens in the HCI device setup path (`h5_serdev_probe` \\u2192 `hci_dev_open_sync` \\u2192 `h5_btrtl_setup` \\u2192 `btrtl_initialize`), driven entirely by local driver probe/open and locally loaded firmware, before any RF link exists. No network or adjacent-network data reaches the vulnerable code, and the UART-attached controller is a permanently soldered on-board device rather than a hot-plugged one.\\nAC:L - The overflow is unconditional and fully deterministic \\u2014 `sizeof_priv` is zero for every RTL H5 device, so every single `btrtl_initialize()`/`btrtl_download_firmware()` run writes past the end of the `hci_dev` allocation with no race, no timing window, and no memory grooming required. It reproduces on the first attempt on every affected system, as the reported KASAN splat from a stock PinePhone boot shows.\\nPR:L - An unprivileged local session user on the affected phone/tablet/laptop class can re-trigger the write at will, because `h5_btrtl_resume()` performs a `device_reprobe()` on RTL8723BS parts and a suspend/resume cycle is permitted to active local sessions by default logind/polkit policy, re-running the full setup path. The write also fires with zero privileges during the automatic boot-time probe; the root/`CAP_NET_ADMIN`-gated `HCIDEVUP` ioctl is only one of several trigger routes, not a required one.\\nUI:N - The out-of-bounds write executes in a kernel workqueue during automatic device probe and power-on, with no administrator or victim action of any kind. The suspend/resume re-trigger is initiated by the attacker\u0027s own process.\\nS:U - The corruption is confined to the kernel slab of the same host and is exploited by, and against, the kernel\u0027s own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\\nC:H - `btrtl_dmp_hdr()` reads the out-of-bounds `rtl_dump.controller` and `rtl_dump.driver_name` fields back as pointers and `snprintf(\\\"%s\\\", ...)`s them into a devcoredump buffer that userspace can read from `/sys/class/devcoredump/`; when that region overlaps a neighbouring slab object whose contents have since changed, this becomes a read of an attacker-influenceable kernel pointer and disclosure of arbitrary kernel memory. The out-of-bounds region also exposes adjacent heap contents to the driver\u0027s own logic (`btrealtek_test_flag`, firmware-version reporting).\\nI:H - This is a confirmed slab out-of-bounds write (KASAN \\\"Write of size 8\\\") of up to 32 bytes \\u2014 two kernel `.rodata` pointers, a firmware-derived `u32`, and a `set_bit()` \\u2014 immediately past the `hci_dev` allocation, at a fixed and predictable offset. Depending on kernel version, architecture, and config (`sizeof(struct hci_dev)` relative to the kmalloc bucket, particularly on the 32-bit ARM boards that use this exact driver), those bytes land in the head of the adjacent heap object, giving a repeatable heap-overflow primitive that can be groomed by controlling what occupies the neighbouring slot.\\nA:H - Corrupting the first bytes of a neighbouring kmalloc object, and later dereferencing pointers read back out of bounds in `btrtl_dmp_hdr()`, readily produces a kernel oops or panic; the access is repeated on every probe, resume, and device open. On builds with KASAN or arm64 MTE (shipped in production on some Android devices), the very first occurrence is a fatal report/panic, and `panic_on_warn`/`panic_on_oops` hardened embedded and automotive builds turn it into an immediate full system outage.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5b355944b19011011dd3fd4187444c5ff1d76ad2\", \"lessThan\": \"dd163fa34c483f1674aa2510accce11a224f649e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5b355944b19011011dd3fd4187444c5ff1d76ad2\", \"lessThan\": \"2f232bc389a4f5943c40733582f9edf77b89e499\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5b355944b19011011dd3fd4187444c5ff1d76ad2\", \"lessThan\": \"0c657e641df1e77d6087688190f632cad9c0439b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5b355944b19011011dd3fd4187444c5ff1d76ad2\", \"lessThan\": \"de4e88ec58c4202efd1f02eebb4939bbf6945358\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/bluetooth/hci_h5.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.23\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/bluetooth/hci_h5.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/dd163fa34c483f1674aa2510accce11a224f649e\"}, {\"url\": \"https://git.kernel.org/stable/c/2f232bc389a4f5943c40733582f9edf77b89e499\"}, {\"url\": \"https://git.kernel.org/stable/c/0c657e641df1e77d6087688190f632cad9c0439b\"}, {\"url\": \"https://git.kernel.org/stable/c/de4e88ec58c4202efd1f02eebb4939bbf6945358\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: btrtl: fix out of bounds memory access\\n\\nThe problem is detected by KASAN.\\nbtrtl driver uses private hci data to store \u0027struct btrealtek_data\u0027.\\nIf btrtl driver is used with btusb, then memory for private hci data\\nis allocated in btusb. But no private data is allocated after hci_dev,\\nwhen btrtl is used with hci_h5.\\n\\nThis commit adds memory allocation for hci_h5 case.\\n\\n ==================================================================\\n BUG: KASAN: slab-out-of-bounds in btrtl_initialize+0x6cc/0x958 [btrtl]\\n Write of size 8 at addr ffff00000f5a5748 by task kworker/u9:0/76\\n\\n Hardware name: Pine64 PinePhone (1.2) (DT)\\n Workqueue: hci0 hci_power_on [bluetooth]\\n Call trace:\\n dump_backtrace+0x9c/0x128\\n show_stack+0x20/0x38\\n dump_stack_lvl+0x48/0x60\\n print_report+0xf8/0x5d8\\n kasan_report+0x90/0xd0\\n __asan_store8+0x9c/0xc0\\n \\t [btrtl]\\n h5_btrtl_setup+0xd0/0x2f8 [hci_uart]\\n h5_setup+0x50/0x80 [hci_uart]\\n hci_uart_setup+0xd4/0x260 [hci_uart]\\n hci_dev_open_sync+0x1cc/0xf68 [bluetooth]\\n hci_dev_do_open+0x34/0x90 [bluetooth]\\n hci_power_on+0xc4/0x3c8 [bluetooth]\\n process_one_work+0x328/0x6f0\\n worker_thread+0x410/0x778\\n kthread+0x168/0x178\\n ret_from_fork+0x10/0x20\\n\\n Allocated by task 53:\\n kasan_save_stack+0x3c/0x68\\n kasan_save_track+0x20/0x40\\n kasan_save_alloc_info+0x68/0x78\\n __kasan_kmalloc+0xd4/0xd8\\n __kmalloc+0x1b4/0x3b0\\n hci_alloc_dev_priv+0x28/0xa58 [bluetooth]\\n hci_uart_register_device+0x118/0x4f8 [hci_uart]\\n h5_serdev_probe+0xf4/0x178 [hci_uart]\\n serdev_drv_probe+0x54/0xa0\\n really_probe+0x254/0x588\\n __driver_probe_device+0xc4/0x210\\n driver_probe_device+0x64/0x160\\n __driver_attach_async_helper+0x88/0x158\\n async_run_entry_fn+0xd0/0x388\\n process_one_work+0x328/0x6f0\\n worker_thread+0x410/0x778\\n kthread+0x168/0x178\\n ret_from_fork+0x10/0x20\\n\\n Last potentially related work creation:\\n kasan_save_stack+0x3c/0x68\\n __kasan_record_aux_stack+0xb0/0x150\\n kasan_record_aux_stack_noalloc+0x14/0x20\\n __queue_work+0x33c/0x960\\n queue_work_on+0x98/0xc0\\n hci_recv_frame+0xc8/0x1e8 [bluetooth]\\n h5_complete_rx_pkt+0x2c8/0x800 [hci_uart]\\n h5_rx_payload+0x98/0xb8 [hci_uart]\\n h5_recv+0x158/0x3d8 [hci_uart]\\n hci_uart_receive_buf+0xa0/0xe8 [hci_uart]\\n ttyport_receive_buf+0xac/0x178\\n flush_to_ldisc+0x130/0x2c8\\n process_one_work+0x328/0x6f0\\n worker_thread+0x410/0x778\\n kthread+0x168/0x178\\n ret_from_fork+0x10/0x20\\n\\n Second to last potentially related work creation:\\n kasan_save_stack+0x3c/0x68\\n __kasan_record_aux_stack+0xb0/0x150\\n kasan_record_aux_stack_noalloc+0x14/0x20\\n __queue_work+0x788/0x960\\n queue_work_on+0x98/0xc0\\n __hci_cmd_sync_sk+0x23c/0x7a0 [bluetooth]\\n __hci_cmd_sync+0x24/0x38 [bluetooth]\\n btrtl_initialize+0x760/0x958 [btrtl]\\n h5_btrtl_setup+0xd0/0x2f8 [hci_uart]\\n h5_setup+0x50/0x80 [hci_uart]\\n hci_uart_setup+0xd4/0x260 [hci_uart]\\n hci_dev_open_sync+0x1cc/0xf68 [bluetooth]\\n hci_dev_do_open+0x34/0x90 [bluetooth]\\n hci_power_on+0xc4/0x3c8 [bluetooth]\\n process_one_work+0x328/0x6f0\\n worker_thread+0x410/0x778\\n kthread+0x168/0x178\\n ret_from_fork+0x10/0x20\\n ==================================================================\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.23\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.11\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.2\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:28:11.662Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-26890\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:28:11.662Z\", \"dateReserved\": \"2024-02-19T14:20:24.186Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-17T10:27:43.438Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…