Security readout for executives and security teams
Plain-English summary
A flaw in the Linux Qualcomm Bluetooth driver could expose sensitive kernel stack data through debugfs when a malformed firmware build-information reply is processed. The supplied CVSS score is 8.1, reflecting potentially serious confidentiality and availability consequences. Practical exposure depends on the affected driver, compatible hardware, kernel build, debugfs accessibility, and distribution backports.
Executive priority
Treat this as a high-priority, hardware-dependent Linux remediation rather than a universal emergency. Quickly identify systems using Qualcomm Bluetooth, confirm distributor backports, and patch exposed assets through normal expedited kernel maintenance. Increase urgency for shared, sensitive, or physically accessible systems. There is no supplied evidence of active exploitation.
Technical view
The Linux Bluetooth QCA code lacked sanity checks when handling firmware build-information replies. Its 255-byte build-ID buffer was stack-allocated, so malformed data could cause uninitialized stack content to appear through debugfs. The Linux fixes add validation and move the buffer off the stack. The source bundle does not establish code execution or data modification.
Likely exposure
Prioritize Linux systems using the QCA Bluetooth driver and relevant Qualcomm Bluetooth hardware. The bundle identifies affected Linux versions including 5.12, 5.15.162, 6.1.91, 6.6.31, 6.8.10, and 6.9, but distribution kernels may contain backports. Internet-only exposure is not indicated; the CVSS vector classifies access as adjacent.
Exploitation context
CISA KEV status is false in the supplied bundle, and no cited source establishes active exploitation or a public exploit. The CVSS vector indicates adjacent access, low complexity, no privileges, and no user interaction. Evidence is insufficient to describe a proven attack path beyond processing a malformed build-information reply and potential disclosure through debugfs.
Researcher notes
The core issue is an information leak caused by inadequate reply validation and a stack-resident build-ID buffer. Upstream supplied five stable commits, suggesting fixes across maintained branches. Exact vulnerable boundaries and downstream backport status are not fully represented by the bundle. Researchers should avoid equating a kernel version string with vulnerability status without checking vendor patches.
Mitigation direction
- Apply a vendor-supported kernel update containing the relevant Linux stable fix or distribution backport.
- Check distribution security advisories before relying on the displayed upstream version numbers.
- Prioritize systems using the QCA Bluetooth driver and compatible Qualcomm Bluetooth hardware.
- Review vendor guidance for temporary controls if immediate kernel replacement is impractical.
Validation and detection
- Record the running kernel package, release, distribution, and vendor patch level.
- Determine whether the QCA Bluetooth driver and relevant hardware are present and active.
- Confirm the installed kernel contains the applicable stable fix or documented backport.
- Verify debugfs exposure and access controls without attempting to trigger malformed firmware responses.
- Re-scan updated systems and retain package or commit evidence for remediation records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-36032 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H2.85.2LinuxCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N0.81.4CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Base CVSS 3.1 score
2.3LowVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/62d5550ab62042dcceaf18844d0feadbb962cffeCVE reference, Linux
- https://git.kernel.org/stable/c/57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488CVE reference, Linux
- https://git.kernel.org/stable/c/6b63e0ef4d3ce0080395e5091fba2023f246c45aCVE reference, Linux
- https://git.kernel.org/stable/c/a571044cc0a0c944e7c12237b6768aeedd7480e1CVE reference, Linux
- https://git.kernel.org/stable/c/cda0d6a198e2a7ec6f176c36173a57bdd8af7af2CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.