Security readout for executives and security teams
Plain-English summary
A flaw in the Linux Bluetooth stack can access memory after it has been freed while handling an L2CAP connection. The supplied CVSS score is 8.8 because a nearby, unauthenticated attacker may potentially affect confidentiality, integrity, and availability without user interaction. The evidence confirms the memory-safety defect but does not establish real-world exploitation.
Executive priority
Remediate on a high-priority, risk-based schedule. Accelerate patching for Bluetooth-enabled devices used in public, shared, or otherwise untrusted physical locations. Internet-only exposure is not indicated, and active exploitation is not established, so this does not presently warrant the urgency reserved for confirmed widespread exploitation.
Technical view
CVE-2024-49950 is a use-after-free in l2cap_connect within net/bluetooth/l2cap_core.c. Syzbot triggered a KASAN read after l2cap_conn_del freed the connection during an asynchronous failure and teardown path. Multiple Linux stable commits are cited as fixes. The bundle identifies affected Linux releases but contains ambiguous version formatting, so distribution-specific package status should be authoritative.
Likely exposure
Exposure is concentrated in systems running affected Linux kernels with Bluetooth and L2CAP functionality available. The adjacent-network CVSS vector indicates the attacker must be nearby rather than internet-remote. Servers, appliances, endpoints, and embedded devices without usable Bluetooth have materially lower practical exposure, although kernel and configuration inventories should confirm this.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no cited evidence of active exploitation or a public weaponized exploit. It was discovered through Syzbot and KASAN testing. Treat exploitation status as unconfirmed, while recognizing that the 8.8 score and unauthenticated adjacent attack vector justify timely remediation.
Researcher notes
The report shows an eight-byte KASAN read in l2cap_connect after l2cap_conn_free released the object through connection-failure teardown. The involved workqueue paths suggest an object-lifetime or concurrency defect. The supplied record does not identify a CWE, proven exploitation primitive, affected configurations beyond Linux Bluetooth/L2CAP, or exploit reliability; avoid inferring code execution from CVSS impacts alone.
Mitigation direction
- Install vendor kernel updates that incorporate the cited Linux stable fixes.
- Check distribution advisories for the corrected package version applicable to each system.
- Disable Bluetooth where operationally unnecessary until affected systems are updated.
- Prioritize exposed laptops, embedded devices, kiosks, and systems in untrusted physical environments.
Validation and detection
- Inventory Linux kernel and distribution package versions across Bluetooth-capable assets.
- Confirm installed packages against vendor advisories, not the bundle's ambiguous version list alone.
- Verify the deployed kernel contains the applicable cited stable fix or vendor backport.
- Confirm unnecessary Bluetooth interfaces are disabled according to organizational policy.
- Monitor kernel logs for Bluetooth faults, KASAN reports, crashes, or unexpected connection failures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49950 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/686e05c9dbd68766c6bda5f31f7e077f36a7fb29CVE reference, Linux
- https://git.kernel.org/stable/c/b22346eec479a30bfa4a02ad2c551b54809694d0CVE reference, Linux
- https://git.kernel.org/stable/c/b90907696c30172b809aa3dd2f0caffae761e4c6CVE reference, Linux
- https://git.kernel.org/stable/c/78d30ce16fdf9c301bcd8b83ce613cea079cea83CVE reference, Linux
- https://git.kernel.org/stable/c/a1c6174e23df10b8e5770e82d63bc6e2118a3dc7CVE reference, Linux
- https://git.kernel.org/stable/c/333b4fd11e89b29c84c269123f871883a30be586CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.