Security readout for executives and security teams
Plain-English summary
A Linux Bluetooth RFCOMM error path can leave a pointer to freed kernel memory. A locally authenticated user may be able to trigger memory corruption, potentially compromising confidentiality, integrity, or availability. The supplied CVSS score is 7.8 (High), but the sources provide no evidence of active exploitation.
Executive priority
Prioritize affected multi-user, workstation, kiosk, and other locally accessible Linux systems. Schedule prompt patching because successful exploitation could provide broad system impact, while recognizing that the supplied evidence does not show active exploitation or remote reachability.
Technical view
If rfcomm_dlc_alloc() fails after bt_sock_alloc() attaches a socket object, the kernel releases that object without clearing the socket's reference, creating a CWE-416 use-after-free. The upstream fix reverses the allocation order so the socket object is not attached before the failure-prone RFCOMM allocation succeeds.
Likely exposure
Exposure is most relevant to Linux systems running an affected kernel where a low-privileged local user can reach Bluetooth RFCOMM socket functionality. The supplied record lists affected versions through 6.13, with several stable updates identified, but does not provide a complete distribution-by-distribution package mapping.
Exploitation context
The CVSS vector describes local access, low complexity, low privileges, and no user interaction, with potentially high confidentiality, integrity, and availability impact. CISA KEV status is false in the supplied bundle, and no cited source establishes public or active exploitation.
Researcher notes
The vulnerable condition depends on rfcomm_dlc_alloc() failing after socket attachment, leaving a dangling sk pointer. The fix changes allocation ordering rather than adding pointer cleanup. The bundle identifies four stable commits, but exact branch-to-commit and distribution package mappings should be confirmed from vendor advisories.
Mitigation direction
- Install the vendor-supported kernel update containing the applicable stable fix.
- Review distribution advisories to identify the corrected package for each deployed kernel.
- If immediate patching is impossible, restrict untrusted local access and unnecessary Bluetooth use.
- Reboot into the corrected kernel after updating, following vendor guidance.
Validation and detection
- Inventory running kernel versions on systems with Bluetooth capability or RFCOMM enabled.
- Confirm the installed kernel contains the applicable referenced stable commit or vendor backport.
- Verify systems are running the updated kernel after reboot, not merely holding an installed package.
- Reassess local-user access to exposed systems while remediation remains pending.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56604 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ac3eaac4cf142a15fe67be747a682b1416efeb6eCVE reference, Linux
- https://git.kernel.org/stable/c/6021ccc2471b7b95e29b7cfc7938e042bf56e281CVE reference, Linux
- https://git.kernel.org/stable/c/32df687e129ef0f9afcbcc914f7c32deb28fd481CVE reference, Linux
- https://git.kernel.org/stable/c/3945c799f12b8d1f49a3b48369ca494d981ac465CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.