Security readout for executives and security teams
Plain-English summary
A Linux Bluetooth driver memory-allocation error can write beyond an allocated object when certain Realtek Bluetooth hardware uses the HCI H5 UART path. The failure occurs during Bluetooth initialization and may crash the system or corrupt kernel memory. The supplied CVSS score is 7.8, but exposure depends on the affected driver and hardware configuration being present.
Executive priority
Treat this as a high-priority, configuration-dependent kernel issue. Quickly identify embedded and endpoint systems using UART-attached Realtek Bluetooth, then apply supported kernel updates. Internet-wide emergency action is not supported by the evidence, but affected systems warrant timely remediation because kernel-memory corruption can have severe consequences.
Technical view
The btrtl driver stores struct btrealtek_data in private HCI memory. btusb allocates that space, while the hci_h5 path did not. During btrtl_initialize, an eight-byte write crossed the allocated slab boundary, as detected by KASAN. The stable fix adds the missing private-data allocation for hci_h5. The supplied classification is CWE-125, although the trace specifically reports an out-of-bounds write.
Likely exposure
Exposure is likely limited to Linux systems using the btrtl Realtek Bluetooth driver through hci_h5, rather than btusb. The bundle identifies Linux 6.2 and several later version markers as affected, but its version data is ambiguous. Embedded, mobile, or appliance platforms with UART-attached Realtek Bluetooth deserve priority. Distribution backports may alter actual status.
Exploitation context
The supplied CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction, with potentially high confidentiality, integrity, and availability impact. However, the bundle provides no demonstrated exploit, attack method, or evidence of active exploitation, and the CVE is not listed as KEV. Practical exploitability is therefore unconfirmed.
Researcher notes
The report documents KASAN slab-out-of-bounds detection during hci_power_on on a Pine64 PinePhone. Root cause is missing HCI private-data allocation in the hci_h5 integration path. The bundle’s affected-version representation contains unclear entries, including “0” and commit identifiers, so authoritative distribution or stable-tree mapping is necessary. No exploitability analysis beyond the CVSS vector is supplied.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix.
- Prioritize systems using Realtek Bluetooth through the HCI H5 UART transport.
- If patching is delayed, consider disabling affected Bluetooth functionality where operationally acceptable.
- Check distribution advisories for backported fixes and exact package versions.
Validation and detection
- Inventory kernel versions, Bluetooth hardware, loaded btrtl modules, and HCI transport configuration.
- Confirm whether Realtek Bluetooth uses hci_h5 rather than btusb.
- Verify installed kernel packages include one of the referenced stable fixes or a documented backport.
- After updating, test Bluetooth initialization and review kernel logs for memory or driver faults.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-26890 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L3.92.5CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/dd163fa34c483f1674aa2510accce11a224f649eCVE reference, Linux
- https://git.kernel.org/stable/c/2f232bc389a4f5943c40733582f9edf77b89e499CVE reference, Linux
- https://git.kernel.org/stable/c/0c657e641df1e77d6087688190f632cad9c0439bCVE reference, Linux
- https://git.kernel.org/stable/c/de4e88ec58c4202efd1f02eebb4939bbf6945358CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.