Critical Bluetooth Vulnerability in Linux Package: btnxpuart Scheduling Issue
Summary
DEBIAN-CVE-2024-26959: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix btnxpuart_close Fix scheduling while atomic BUG in btnxpuart_close(), properly purge the transmit queue and free the receive s... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing the essential kernel functionalities that enable hardware interaction and system management. It supports a wide range of hardware devices and is crucial for system stability and performance. The package is frequently updated to address security vulnerabilities and improve functionality. This specific vulnerability affects the Bluetooth subsystem, particularly the btnxpuart driver, which is responsible for managing Bluetooth communications over UART interfaces.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-26959 arises from a scheduling issue in the btnxpuart_close function within the Bluetooth subsystem of the Linux kernel. This flaw can lead to a 'scheduling while atomic' bug, which may cause system instability or crashes when the Bluetooth device is being closed. The issue is triggered during the process of purging the transmit queue and freeing the receive socket buffer (skb), potentially leading to unexpected behavior in the Bluetooth stack. The vulnerability has been documented with specific error messages and call traces that indicate the failure points in the code.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the Bluetooth functionality until the package is updated. Additionally, ensuring that the Bluetooth device is not actively in use during system shutdown may help mitigate the risk of encountering the bug.
Conclusion
In summary, the DEBIAN-CVE-2024-26959 vulnerability affects the Linux package's Bluetooth subsystem, specifically the btnxpuart driver. Users are advised to update to the patched version to ensure system stability and security. Temporary workarounds are available for those unable to update immediately.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a scheduling issue in the Bluetooth subsystem of the Linux kernel that can lead to system instability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability could lead to system crashes or instability when interacting with Bluetooth devices.
Yes, a patch is available in version 6.7.12-1 of the Linux package. Users should update to this version or later.
As a temporary measure, avoid using Bluetooth functionality until the package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
