Security readout for executives and security teams
Plain-English summary
A flaw in the Linux Bluetooth driver for MediaTek USB devices can free the same memory twice during coredump error handling. This can corrupt kernel memory and potentially crash or compromise an affected system. Exposure depends on the installed kernel, relevant MediaTek Bluetooth hardware, and whether the vulnerable coredump path is reachable.
Executive priority
Prioritize confirmation and patching for Linux endpoints using MediaTek Bluetooth, especially sensitive or high-availability systems. The high CVSS score warrants timely action, but current evidence does not support declaring an emergency based on active exploitation. Systems without the relevant driver or hardware are less likely to be exposed.
Technical view
The MediaTek btusb coredump caller freed an skb after hci_devcd_append() had already freed it on error, causing a kernel double free. The supplied CVSS 3.1 score is 8.8 with adjacent-network reachability and possible confidentiality, integrity, and availability impact. The bundle does not establish a specific attack path or resulting code execution.
Likely exposure
Potentially exposed systems run an affected Linux kernel and use the relevant MediaTek btusb functionality. The bundle lists affected versions including 6.6, 6.6.30, 6.8.9, and 6.9, but its version formatting is ambiguous. Confirm exact distribution kernel status and backports with the operating-system vendor.
Exploitation context
The CVE is not identified as CISA KEV in the supplied bundle, and no cited source reports active exploitation. The adjacent-network CVSS vector suggests proximity is required, but the bundle does not explain how an attacker could reliably trigger the coredump error path. Treat exploitability beyond memory corruption as unconfirmed.
Researcher notes
The confirmed defect is incorrect skb ownership handling: hci_devcd_append() frees the buffer on error, and the caller freed it again. Stable-kernel commits are supplied as fixes. The bundle provides no CWE assignment, reproducer, exploit analysis, affected distribution mapping, or evidence that confidentiality and integrity impacts have been demonstrated.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the applicable stable fix.
- Check distribution advisories for backported fixes and exact affected package versions.
- Prioritize systems using MediaTek USB Bluetooth hardware or the btusb MediaTek driver.
- Follow vendor guidance if an immediate patched kernel is unavailable.
Validation and detection
- Inventory Linux kernel versions and identify systems using MediaTek USB Bluetooth hardware.
- Confirm the installed kernel includes the applicable referenced stable fix or vendor backport.
- Review vendor advisories because distribution package versions may not match upstream versions.
- Monitor kernel and Bluetooth logs for coredump failures, memory corruption, or unexpected crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-35856 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/80dfef128cb9f1b1ef67c0fe8c8deb4ea7ad30c1CVE reference, Linux
- https://git.kernel.org/stable/c/e20093c741d8da9f6390dd45d75b779861547035CVE reference, Linux
- https://git.kernel.org/stable/c/18bdb386a1a30e7a3d7732a98e45e69cf6b5710dCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.