CVE-2024-56591

A flaw was found in the Bluetooth subsystem of the Linux kernel, in the handling of delayed work within the hci_conn (Host Controller Interface connection) structure. The kernel used cancel_delayed_work_sync() when shutting down a connection, which cancels ongoing work but allows rescheduling. This could result in use-after-free conditions if the work is resubmitted after the associated object has been freed. Replacing it with disable_delayed_work_sync() prevents further scheduling, ensuring proper cleanup. A local attacker could potentially exploit this to trigger a use-after-free, leading to a denial of service or possible code execution.

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Use disable_delayed_work_sync This makes use of disable_delayed_work_sync instead cancel_delayed_work_sync as it not only cancel the ongoing work but also disables new submit which is disarable since the object holding the work is about to be freed.

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.