Answer in brief
CVE-2024-36013 records a High severity (CVSS 8.8) vulnerability in Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | 3.0 | Not reported |
| Linux/Linuxgeneric | >=73ffa904b78287f6acf8797e040150aa26a4af4a <8629a65a48890769c47ebc9b6e57c02a80a8975e || >=73ffa904b78287f6acf8797e040150aa26a4af4a <cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5 || >=73ffa904b78287f6acf8797e040150aa26a4af4a <826af9d2f69567c646ff46d10393d47e30ad23c6 || >=73ffa904b78287f6acf8797e040150aa26a4af4a <4d7b41c0e43995b0e992b9f8903109275744b658 | 8629a65a48890769c47ebc9b6e57c02a80a8975e, cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5, 826af9d2f69567c646ff46d10393d47e30ad23c6, 4d7b41c0e43995b0e992b9f8903109275744b658 |
Published upstream
May 23, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() Extend a critical section to prevent chan from early freeing. Also make the l2cap_connect() return type void. Nothing is using the returned value but it is ugly to return a potentially freed pointer. Making it void will help with backports because earlier kernels did use the return value. Now the compile will break for kernels where this patch is not a complete fix. Call stack summary: [use] l2cap_bredr_sig_cmd l2cap_connect ┌ mutex_lock(&conn->chan_lock); │ chan = pchan->ops->new_connection(pchan); <- alloc chan │ __l2cap_chan_add(conn, chan); │ l2cap_chan_hold(chan); │ list_add(&chan->list, &conn->chan_l); ... (1) └ mutex_unlock(&conn->chan_lock); chan->conf_state ... (4) <- use after free [free] l2cap_conn_del ┌ mutex_lock(&conn->chan_lock); │ foreach chan in conn->chan_l: ... (2) │ l2cap_chan_put(chan); │ l2cap_chan_destroy │ kfree(chan) ... (3) <- chan freed └ mutex_unlock(&conn->chan_lock); ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0 net/bluetooth/l2cap_core.c:4260 Read of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311
Quoted source text, attributed separately from HOL analysis.