Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel Bluetooth management subsystem can crash a system when a Bluetooth controller index is removed while synchronized commands remain queued. The supplied CVSS score is 7.8, reflecting local, low-privilege access and potentially serious impact. The evidence directly demonstrates a crash; it does not establish broader compromise mechanics.
Executive priority
Treat this as a high-priority kernel maintenance issue on Bluetooth-enabled, multi-user, kiosk, desktop, and edge systems. Patch through normal emergency or accelerated maintenance processes after confirming distributor applicability. Urgency is lower where Bluetooth is absent or unused, but the supplied sources do not define that as a complete mitigation.
Technical view
During mgmt_index_removed handling, queued cmd_sync commands may retain pending management entries. Removing those entries during completion processing can trigger invalid linked-list deletion and a kernel crash. Linux stable commits resolve the condition by dequeuing commands passed as user_data while processing index removal.
Likely exposure
Exposure is most plausible on affected Linux kernels using the Bluetooth MGMT subsystem, particularly where controller removal can coincide with queued synchronized commands. The supplied affected-version data lists 6.0, 6.1.120, 6.6.55, 6.10.14, 6.11.3, and 6.12, but does not clearly express version ranges.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. The supplied record is not in KEV, and no cited source claims active exploitation. Available evidence documents a crash condition rather than a proven real-world exploitation campaign or demonstrated confidentiality and integrity compromise.
Researcher notes
The crash trace indicates invalid list deletion during asynchronous Bluetooth management completion. Five Linux stable commits are referenced, likely covering maintained branches. The supplied affected-version representation is ambiguous and includes duplicated commit identifiers plus an isolated "0" value; use branch-specific commits and distribution advisories rather than assuming precise ranges from this bundle.
Mitigation direction
- Apply a distributor kernel update that incorporates the applicable Linux stable fix.
- Check Linux distribution advisories to identify the correct fixed package for each deployed kernel.
- Prioritize systems that actively use Bluetooth or permit local untrusted users.
- Follow vendor guidance when exact affected and fixed version boundaries remain unclear.
Validation and detection
- Inventory deployed kernel versions and whether the Bluetooth subsystem is enabled or used.
- Map each kernel package to its distributor advisory and applicable stable fix commit.
- Verify the running kernel after updating, not only the installed package.
- Review kernel logs for crashes referencing mgmt_pending_remove, mgmt_remove_adv_monitor_complete, or hci_cmd_sync_work.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49951 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/19b40ca62607cef78369549d1af091f2fd558931CVE reference, Linux
- https://git.kernel.org/stable/c/4883296505aa7e4863c6869b689afb6005633b23CVE reference, Linux
- https://git.kernel.org/stable/c/0cc47233af35fb5f10b5e6a027cb4ccd480caf9aCVE reference, Linux
- https://git.kernel.org/stable/c/8c3f7943a29145d8a2d8e24893762f7673323eaeCVE reference, Linux
- https://git.kernel.org/stable/c/f53e1c9c726d83092167f2226f32bd3b73f26c21CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.