Security readout for executives and security teams
Plain-English summary
A Linux Bluetooth component can access memory after it has been freed during device shutdown. This can crash the system and may permit broader compromise when triggered by a local, low-privileged user. The supplied evidence demonstrates the memory-safety failure, but does not establish successful exploitation.
Executive priority
Treat as a high-priority kernel maintenance issue, especially on Bluetooth-enabled endpoints shared with untrusted local users. Accelerate supported kernel updates, but avoid declaring an emergency solely from the severity score: the supplied sources show a local memory-safety flaw without evidence of active exploitation.
Technical view
A lifetime race allows msft_do_close() to retain hdev->msft_data while msft_unregister() clears and frees it. The close path then accesses the freed filter_lock, producing a KASAN slab-use-after-free report. The kernel fix ties msft_data lifetime to the HCI device and defers freeing until hci_release_dev().
Likely exposure
Exposure is limited to Linux systems using affected kernel code and the relevant Bluetooth Microsoft-extension path. The record lists affected Linux versions beginning at 5.12, but its supplied version data is insufficient for reliable distribution-specific conclusions. Vendor kernels may contain backports despite reporting older version numbers.
Exploitation context
The CVSS vector describes local access, low complexity, low privileges, and no user interaction, with potentially high confidentiality, integrity, and availability impact. CISA KEV status is false in the supplied bundle, and no cited source establishes active exploitation or a public weaponized exploit.
Researcher notes
The demonstrated failure is an eight-byte read from a freed slab object during mutex acquisition. The source describes a specific lifetime correction, but does not provide evidence that the condition reliably yields code execution or information disclosure. Distribution-specific affected and fixed build mappings require vendor confirmation.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable referenced stable fix or an equivalent backport.
- Check distribution security guidance because kernel version numbers alone may not reveal backported fixes.
- Prioritize Bluetooth-capable multi-user systems where untrusted local users can execute code.
- Use normal change controls and reboot into the corrected kernel after installation.
Validation and detection
- Inventory running kernel builds on systems with Bluetooth hardware or Bluetooth services enabled.
- Confirm the applicable stable commit or documented vendor backport is included in each running kernel.
- Review kernel and KASAN logs for use-after-free reports involving msft_do_close or mutex locking.
- After remediation, verify systems booted the corrected kernel rather than only installing it.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-36012 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e3880b531b68f98d3941d83f2f6dd11cf4fd6b76CVE reference, Linux
- https://git.kernel.org/stable/c/a85a60e62355e3bf4802dead7938966824b23940CVE reference, Linux
- https://git.kernel.org/stable/c/4f1de02de07748da80a8178879bc7a1df37fdf56CVE reference, Linux
- https://git.kernel.org/stable/c/10f9f426ac6e752c8d87bf4346930ba347aaabacCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.