Security readout for executives and security teams
Plain-English summary
CVE-2024-27398 is a Linux kernel Bluetooth flaw where a delayed SCO socket timeout can touch memory after the socket was freed. That can crash or corrupt kernel memory. The source bundle shows a KASAN proof of concept, but no KEV listing or cited active exploitation.
Executive priority
Treat this as a kernel maintenance priority, especially for fleets with Bluetooth enabled. It is not currently evidenced as actively exploited, but kernel memory-safety bugs deserve timely patching because impact can exceed ordinary application crashes.
Technical view
The bug is a use-after-free race in Linux Bluetooth SCO handling. sco_sock_release schedules timeout_work, sock_put can free the socket, and sco_sock_timeout later dereferences it. The fix is present in multiple upstream stable commits for affected kernel lines.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions with Bluetooth SCO support enabled or reachable. Servers without Bluetooth enabled likely have lower practical exposure, but kernel version, config, and vendor backports should be verified.
Exploitation context
The bundle includes a KASAN report triggered by a proof of concept and lists upstream stable fixes. It does not provide CVSS, CWE, confirmed impact beyond use-after-free, public weaponization, or active exploitation evidence. KEV is false.
Researcher notes
The source evidence is strongest on root cause and fix path, not exploitability. Preserve nuance: established SCO connection plus socket release creates a race with timeout_work. Avoid asserting privilege escalation or remote exploitation unless vendor analysis adds that detail.
Mitigation direction
- Apply vendor kernel updates that include the listed stable Bluetooth fixes.
- Check Linux distribution advisories for the exact fixed package version.
- Disable Bluetooth where it is not operationally required.
- Prioritize laptops, workstations, IoT, and systems with Bluetooth enabled.
- Do not rely only on upstream version strings; verify backported fixes.
Validation and detection
- Inventory Linux kernel versions and distribution package revisions.
- Check whether Bluetooth and SCO support are enabled on exposed systems.
- Confirm the relevant stable fix or vendor backport is installed.
- Review Fedora, Debian, and vendor advisories for patched package status.
- Monitor kernel logs for Bluetooth-related crashes during remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-27398 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1b33d55fb7355e27f8c82cd4ecd560f162469249CVE reference, Linux
- https://git.kernel.org/stable/c/3212afd00e3cda790fd0583cb3eaef8f9575a014CVE reference, Linux
- https://git.kernel.org/stable/c/33a6e92161a78c1073d90e27abe28d746feb0a53CVE reference, Linux
- https://git.kernel.org/stable/c/6a18eeb1b3bbc67c20d9609c31dca6a69b4bcde5CVE reference, Linux
- https://git.kernel.org/stable/c/bfab2c1f7940a232cd519e82fff137e308abfd93CVE reference, Linux
- https://git.kernel.org/stable/c/012363cb1bec5f33a7b94629ab2c1086f30280f2CVE reference, Linux
- https://git.kernel.org/stable/c/50c2037fc28df870ef29d9728c770c8955d32178CVE reference, Linux
- https://git.kernel.org/stable/c/483bc08181827fc475643272ffb69c533007e546CVE reference, Linux
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTB4HWU2PTVW5NEYHHLOCXDKG3PYA534/CVE reference, CVE · x_transferred
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DW2MIOIMOFUSNLHLRYX23AFR36BMKD65/CVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00019.htmlCVE reference, CVE · x_transferred
- https://security.netapp.com/advisory/ntap-20240912-0012/CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.