Security readout for executives and security teams
Plain-English summary
A Linux Bluetooth device-lifecycle flaw can leave the kernel referencing freed memory while network devices are removed. A nearby attacker may be able to trigger serious system compromise or disruption according to the supplied CVSS assessment, but the sources provide no evidence of real-world exploitation.
Executive priority
Treat this as a high-priority kernel maintenance issue for Bluetooth-enabled endpoints, appliances, and hosts exposed to nearby untrusted devices. Accelerate supported updates, while avoiding claims of an emergency exploitation campaign: none is evidenced in the supplied sources.
Technical view
CVE-2024-53237 is a CWE-416 use-after-free involving delayed child-device reparenting during Bluetooth HCI teardown. A parent controller can be deleted while a child retains a dangling parent pointer, later accessed through device_for_each_child(). The stable fix explicitly reparents the child to NULL before unregistering it.
Likely exposure
Exposure requires a Linux kernel build covered by the affected ranges and relevant Bluetooth functionality. The adjacent-network CVSS vector indicates proximity rather than internet reachability. The supplied version data mixes release numbers and commit identifiers, so organizations should confirm exact exposure through their distribution or kernel vendor.
Exploitation context
The issue was found by syzbot and demonstrated as a KASAN-detected kernel memory error. CISA KEV status is false, and the supplied sources do not report active exploitation or a public weaponized exploit. Practical exploitability beyond triggering a fault remains unclear.
Researcher notes
The reported path crosses hci_conn_del_sysfs(), device_unregister(), BNEP network-device teardown, and device_for_each_child(). Reference counting delays reparenting until final release, allowing the HCI parent to disappear first. The fix removes the dangling relationship explicitly. The source bundle does not establish reliable exploitation, prerequisites beyond Bluetooth context, or affected distribution package mappings.
Mitigation direction
- Install a vendor-supported kernel update containing the cited stable fix.
- Confirm the selected distribution package addresses CVE-2024-53237 before deployment.
- Follow distribution or kernel-vendor guidance for any temporary mitigation.
- Prioritize Bluetooth-capable systems where untrusted nearby devices may interact.
Validation and detection
- Inventory running kernel builds and identify systems providing Bluetooth functionality.
- Compare exact package revisions with distribution advisories and cited stable commits.
- After updating, verify systems booted into the corrected kernel build.
- Review kernel logs for Bluetooth teardown faults or use-after-free indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-53237 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6894717a1ea363c5a27010ba604f957c309d282dCVE reference, Linux
- https://git.kernel.org/stable/c/fb91ce37dc9a37ea23cf32b6d7b667004e93d4c5CVE reference, Linux
- https://git.kernel.org/stable/c/a9584c897d1cba6265c78010bbb45ca5722c88bcCVE reference, Linux
- https://git.kernel.org/stable/c/0f67ca2a80acf8b207240405b7f72d660665d3dfCVE reference, Linux
- https://git.kernel.org/stable/c/de5a44f351ca7efd9add9851b218f5353e2224b7CVE reference, Linux
- https://git.kernel.org/stable/c/91e2a2e4d1336333804cd31162984f01ad8cc70fCVE reference, Linux
- https://git.kernel.org/stable/c/7b277bd569bb6a2777f0014f84b4344f444fd49dCVE reference, Linux
- https://git.kernel.org/stable/c/27aabf27fd014ae037cc179c61b0bee7cff55b3dCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.