8.8

CVE-2024-36013: linux Use After Free

CVSS: 8.8v3.1HighModified
AliasesUBUNTU-CVE-2024-36013DEBIAN-CVE-2024-36013
Published 23-05-2024Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2024-36013 is a high (CVSS 8.8) Use After Free vulnerability in linux. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.48%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 17 · Related 16
RHSA-2025:6966SUSE-SU-2024:2135-1SUSE-SU-2024:2203-1SUSE-SU-2024:2973-1SUSE-SU-2024:3189-1SUSE-SU-2024:3190-1

Timeline

  1. 23-05-2024
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() Extend a critical section to prevent chan from early freeing. Also make the l2cap_connect() return type void. Nothing is using the returned value but it is ugly to return a potentially freed pointer. Making it void will help with backports because earlier kernels did use the return value. Now the compile will break for kernels where this patch is not a complete fix. Call stack summary: [use] l2cap_bredr_sig_cmd l2cap_connect ┌ mutex_lock(&conn->chan_lock); │ chan = pchan->ops->new_connection(pchan); <- alloc chan │ __l2cap_chan_add(conn, chan); │ l2cap_chan_hold(chan); │ list_add(&chan->list, &conn->chan_l); ... (1) └ mutex_unlock(&conn->chan_lock); chan->conf_state ... (4) <- use after free [free] l2cap_conn_del ┌ mutex_lock(&conn->chan_lock); │ foreach chan in conn->chan_l: ... (2) │ l2cap_chan_put(chan); │ l2cap_chan_destroy │ kfree(chan) ... (3) <- chan freed └ mutex_unlock(&conn->chan_lock); ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0 net/bluetooth/l2cap_core.c:4260 Read of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.48%

Chance of exploitation in the next 30 days

Percentile

40%

Versus all other CVEs

30-day change

0.00 pp

From 0.48% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.48%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu129 products
  • linuxAll versions (No fix recorded) | < 6.8.0-40.40
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 6.8.0-1013.14
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 73ffa904b78287f6acf8797e040150aa26a4af4a, < 8629a65a48890769c47ebc9b6e57c02a80a8975e | ≥ 73ffa904b78287f6acf8797e040150aa26a4af4a, < cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5 | ≥ 73ffa904b78287f6acf8797e040150aa26a4af4a, < 826af9d2f69567c646ff46d10393d47e30ad23c6 | ≥ 73ffa904b78287f6acf8797e040150aa26a4af4a, < 4d7b41c0e43995b0e992b9f8903109275744b658 | 3.0
  • linux_kernel≥ 3.0, < 6.6.32 | ≥ 6.7, < 6.8.11 | 6.9:rc1 | 6.9:rc2 | 6.9:rc3 | 6.9:rc4 | 6.9:rc5 | 6.9:rc6 | 6.9:rc7
Debian1 product
  • linux< 6.1.180-1 | < 6.8.11-1

3 vendors · 132 products

References

15 links
Show all 15 references