8.8

CVE-2024-26801: Bluetooth: Avoid potential use-after-free in hci_error_reset

Modified
AliasesUBUNTU-CVE-2024-26801DEBIAN-CVE-2024-26801
Published 04-04-2024Last modified 05-08-2026

Vulnerability summary

CVE-2024-26801 is a high (CVSS 8.8) Use After Free vulnerability in linux. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.8% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 8.8, adjacent network); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.43%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 33 · Related 23
DLA-3840-1DLA-3842-1DSA-5681-1RHSA-2024:4211RHSA-2024:4349RHSA-2024:4352

Timeline

  1. 04-04-2024
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Avoid potential use-after-free in hci_error_reset While handling the HCI_EV_HARDWARE_ERROR event, if the underlying BT controller is not responding, the GPIO reset mechanism would free the hci_dev and lead to a use-after-free in hci_error_reset. Here's the call trace observed on a ChromeOS device with Intel AX201: queue_work_on+0x3e/0x6c __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth <HASH:3b4a6>] ? init_wait_entry+0x31/0x31 __hci_cmd_sync+0x16/0x20 [bluetooth <HASH:3b4a 6>] hci_error_reset+0x4f/0xa4 [bluetooth <HASH:3b4a 6>] process_one_work+0x1d8/0x33f worker_thread+0x21b/0x373 kthread+0x13a/0x152 ? pr_cont_work+0x54/0x54 ? kthread_blkcg+0x31/0x31 ret_from_fork+0x1f/0x30 This patch holds the reference count on the hci_dev while processing a HCI_EV_HARDWARE_ERROR event to avoid potential crash.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.43% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu116 products
  • linux< 4.4.0-254.288 | < 4.15.0-225.237 | < 5.4.0-186.206 | < 5.15.0-112.122
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 4.4.0-1131.137 | < 4.4.0-1169.184 | < 4.15.0-1168.181 | < 5.4.0-1126.136 | < 5.15.0-1063.69
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ c7741d16a57cbf97eebe53f27e8216b1ff20e20c, < e0b278650f07acf2e0932149183458468a731c03 | ≥ c7741d16a57cbf97eebe53f27e8216b1ff20e20c, < 98fb98fd37e42fd4ce13ff657ea64503e24b6090 | ≥ c7741d16a57cbf97eebe53f27e8216b1ff20e20c, < 6dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e2 | ≥ c7741d16a57cbf97eebe53f27e8216b1ff20e20c, < da4569d450b193e39e87119fd316c0291b585d14 | ≥ c7741d16a57cbf97eebe53f27e8216b1ff20e20c, < 45085686b9559bfbe3a4f41d3d695a520668f5e1 | ≥ c7741d16a57cbf97eebe53f27e8216b1ff20e20c, < 2ab9a19d896f5a0dd386e1f001c5309bc35f433b | ≥ c7741d16a57cbf97eebe53f27e8216b1ff20e20c, < dd594cdc24f2e48dab441732e6dfcafd6b0711d1 | ≥ c7741d16a57cbf97eebe53f27e8216b1ff20e20c, < 2449007d3f73b2842c9734f45f0aadb522daf592 | 4.0
  • linux_kernel≥ 4.0, < 4.19.309 | ≥ 4.20, < 5.4.271 | ≥ 5.5, < 5.10.212 | ≥ 5.11, < 5.15.151 | ≥ 5.16, < 6.1.81 | ≥ 6.2, < 6.6.21 | ≥ 6.7, < 6.7.9 | 6.8:rc1 | 6.8:rc2 | 6.8:rc3 | 6.8:rc4 | 6.8:rc5 | 6.8:rc6
Debian1 product
  • linux< 6.1.82-1 | < 6.7.9-1

3 vendors · 119 products

References

31 links
Show all 31 references