CVE-2024-41062
In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock…
- Risk score
- 53/100
- CVSS
- 5.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 29 Jul 2024
Open in the live forecast Today's forecast
What to know
- What it is
- In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock recv cb and release The problem occurs between the system call to close the sock and hci_rx_work, where the former releases the sock and the latter accesses it without lock protection. CPU0 CPU1 sock_close hci_rx_work l2cap_…
- Affected
- Linux kernel
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Linux kernel: Amber, patch this week. In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH) while skb_network_header() points at the IPv6 header. When segments_left > 0, ipv6_srh_rcv() previously restored the …
The flaws
- CVE-2024-41062: In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock… (CVSS 5.5 · EPSS 0%)
- CVE-2026-98096: Out-of-bounds write (CVSS 7.4 · EPSS 1%)
- CVE-2026-98115: Race condition (CVSS 8.8 · EPSS 0%)
- CVE-2026-98117: Use-after-free (CVSS 7.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Linux kernel
Where it stands
- No known exploitation
How it unfolded
- 3 Nov, Ubuntu security notices (official): USN-8962-1: Linux kernel (Azure CVM) vulnerabilities
- 3 Nov, Ubuntu security notices (official): USN-8963-1: Linux kernel (NVIDIA Tegra) vulnerabilities
- 3 Nov, Ubuntu security notices (official): USN-8961-1: Linux kernel vulnerabilities
Connects to
- Same weakness: Out-of-bounds write (CWE-787). 365 other warnings in 30 days
- Same product: Earlier Linux kernel warnings. 105 in the last 90 days
Why it is Yellow
- CVSS 5.5 medium
- On your watchlist: linux kernel
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-8961-1
- https://ubuntu.com/security/notices/USN-8963-1
- https://ubuntu.com/security/notices/USN-8962-1
- https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629
- https://git.kernel.org/stable/c/59a3ccd749b2550392ee531b4d727022eae4c89f
- https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf
- https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe
- https://git.kernel.org/stable/c/9c0b7d61cf3c00f87f2529b5b8b785f0f65089aa
- https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6
- https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629
Original description
In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock recv cb and release The problem occurs between the system call to close the sock and hci_rx_work, where the former releases the sock and the latter accesses it without lock protection. CPU0 CPU1 ---- ---- sock_close hci_rx_work l2cap_sock_release hci_acldata_packet l2cap_sock_kill l2cap_recv_frame sk_free l2cap_conless_channel l2cap_sock_recv_cb If hci_rx_work processes the data that needs to be received before the sock is closed, then everything is normal; Otherwise, the work thread may access the released sock when receiving data. Add a chan mutex in the rx callback of the sock to achieve synchronization between the sock release and recv cb. Sock is dead, so set chan data to NULL, avoid others use invalid sock pointer.
Last activity 3 Nov 2026. Patch Forecast updates every hour.