LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26801: Bluetooth: Avoid potential use-after-free in hci_error_reset

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Avoid potential use-after-free in hci_error_reset While handling the HCI_EV_HARDWARE_ERROR event, if the underlying BT controller is not responding, the GPIO reset mechanism would free the hci_dev and lead to a use-after-free in hci_error_reset. Here's the call trace observed on a ChromeOS device with Intel AX201: queue_work_on+0x3e/0x6c __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth <HASH:3b4a6>] ? init_wait_entry+0x31/0x31 __hci_cmd_sync+0x16/0x20 [bluetooth <HASH:3b4a 6>] hci_error_reset+0x4f/0xa4 [bluetooth <HASH:3b4a 6>] process_one_work+0x1d8/0x33f worker_thread+0x21b/0x373 kthread+0x13a/0x152 ? pr_cont_work+0x54/0x54 ? kthread_blkcg+0x31/0x31 ret_from_fork+0x1f/0x30 This patch holds the reference count on the hci_dev while processing a HCI_EV_HARDWARE_ERROR event to avoid potential crash.

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux Bluetooth error-recovery flaw can access a device object after it has been freed, potentially crashing the system. The failure was observed when an unresponsive Bluetooth controller triggered hardware-error handling and GPIO reset. Systems using affected kernels and Bluetooth hardware warrant prioritized patch review, especially endpoints where nearby Bluetooth interaction is possible.

Executive priority

Prioritize remediation in the next accelerated kernel maintenance cycle, with earlier action for widely deployed Bluetooth-enabled endpoints. Immediate emergency response is not supported by the available exploitation evidence, but the high CVSS score and kernel-level memory-safety failure justify prompt inventory, vendor confirmation, patching, and monitoring.

Technical view

During HCI_EV_HARDWARE_ERROR processing, GPIO-based controller reset can release hci_dev while hci_error_reset still uses it, creating a use-after-free. The kernel correction retains an hci_dev reference throughout event processing. The supplied CVSS 3.1 score is 8.8 with adjacent-network reachability and high confidentiality, integrity, and availability impacts.

Likely exposure

Exposure requires an affected Linux kernel with the Bluetooth subsystem and a controller entering the described unresponsive hardware-error/reset path. The report came from ChromeOS with Intel AX201, but the sources do not establish that exposure is limited to that platform or adapter. The supplied version data is ambiguous, so verify distribution-specific kernel builds against vendor guidance and stable fixes.

Exploitation context

The supplied record is not in CISA KEV, and no cited source reports active exploitation or a public exploit. The CVSS vector identifies adjacent-network attack potential without privileges or user interaction, but the provided technical evidence demonstrates a crash condition rather than a confirmed exploitation method. Treat broader confidentiality or integrity impact as scored potential, not demonstrated compromise.

Researcher notes

The triggering sequence depends on HCI hardware-error handling, an unresponsive controller, and GPIO reset releasing hci_dev. The fix addresses object lifetime by holding a reference during processing. The source bundle provides several stable-branch commits but no clear branch-to-version mapping, root introduction range, CWE assignment, exploit evidence, or proof that impacts beyond denial of service are achievable.

Mitigation direction

  • Install the distribution or device-vendor kernel update containing the applicable stable fix.
  • Match custom kernels against the referenced stable commits and backport the reference-counting correction when necessary.
  • Prioritize Bluetooth-enabled laptops, ChromeOS-derived devices, and systems using controller GPIO reset paths.
  • If updates are delayed, assess disabling unnecessary Bluetooth functionality under organizational change controls.

Validation and detection

  • Record each system's running kernel build, distribution package revision, Bluetooth status, and controller model.
  • Confirm the installed package includes the applicable stable commit or vendor-documented backport.
  • Review kernel logs for HCI hardware errors, controller timeouts, Bluetooth resets, crashes, or use-after-free reports.
  • After updating, reboot and verify the corrected kernel is active across the managed fleet.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26801 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
11Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

8.8High
CVSS 3.1 vector shape for CVE-2024-26801Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc7741d16a57cbf97eebe53f27e8216b1ff20e20c, c7741d16a57cbf97eebe53f27e8216b1ff20e20c, c7741d16a57cbf97eebe53f27e8216b1ff20e20c, c7741d16a57cbf97eebe53f27e8216b1ff20e20c, c7741d16a57cbf97eebe53f27e8216b1ff20e20c, c7741d16a57cbf97eebe53f27e8216b1ff20e20c, c7741d16a57cbf97eebe53f27e8216b1ff20e20c, c7741d16a57cbf97eebe53f27e8216b1ff20e20cunaffected
LinuxLinux4.0, 0, 4.19.309, 5.4.271, 5.10.212, 5.15.151, 6.1.81, 6.6.21, 6.7.9, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.