Security readout for executives and security teams
Plain-English summary
A race condition in the Linux Bluetooth L2CAP code can access memory after it has been freed. A nearby, unauthenticated Bluetooth peer may be able to trigger serious confidentiality, integrity, or availability impact. The supplied sources confirm a kernel fix but do not establish real-world exploitation.
Executive priority
Treat this as a high-priority patching issue for Bluetooth-capable Linux endpoints in public, shared, industrial, or otherwise untrusted physical environments. Prioritize confirmed Bluetooth exposure first. Broader emergency response is not supported because the supplied evidence does not show active exploitation.
Technical view
CVE-2024-36013 is a CWE-416 slab use-after-free in l2cap_connect(). l2cap_conn_del() could free a channel after its insertion into the connection list but before later access to chan->conf_state. The fix extends the chan_lock critical section and changes l2cap_connect() to return void, helping expose incomplete backports at compile time.
Likely exposure
Exposure primarily concerns Linux systems using affected kernel builds with Bluetooth and L2CAP available to nearby devices. The CVSS adjacent-network vector limits reach compared with an Internet-routable flaw. The supplied affected-version list lacks sufficient range semantics, so distribution-specific kernel advisories should determine exposure.
Exploitation context
The CVSS 3.1 score is 8.8 with adjacent access, low complexity, no privileges, and no user interaction. CISA KEV status is false in the supplied bundle, and no cited source reports active exploitation or a public exploit. Practical exploitability beyond the documented KASAN crash is not established here.
Researcher notes
The documented race spans channel creation and connection teardown. KASAN observed an eight-byte read after l2cap_chan_destroy() freed the channel. The lock-scope change is the substantive correction; the void return type supports safer backport verification. Exact affected release boundaries cannot be reconstructed confidently from the flattened version data supplied.
Mitigation direction
- Update to a vendor-supported kernel incorporating the applicable cited stable fix.
- Check distribution guidance to map packaged kernel versions to the upstream fix.
- Prioritize systems with enabled Bluetooth interfaces or exposure to untrusted nearby devices.
- Reboot into the corrected kernel when required by the operating-system vendor.
Validation and detection
- Inventory running kernel and distribution package versions across Linux systems.
- Identify systems where Bluetooth hardware, services, and L2CAP are available.
- Compare each build with vendor advisories and the cited stable commits.
- After remediation, confirm the corrected kernel is running.
- Review Bluetooth-related kernel crashes or memory-safety alerts for possible prior triggering.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-36013 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxCVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H0.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
6.8MediumVector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8629a65a48890769c47ebc9b6e57c02a80a8975eCVE reference, Linux
- https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5CVE reference, Linux
- https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d47e30ad23c6CVE reference, Linux
- https://git.kernel.org/stable/c/4d7b41c0e43995b0e992b9f8903109275744b658CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.