Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (CVE-2024-50029) | HOL Guard CVE

High · CVSS 8.8CVE-2024-50029

Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync

Answer in brief

CVE-2024-50029 records a High severity (CVSS 8.8) vulnerability in Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Oct 21, 2024Updated Sep 14, 2026Source checked Sep 20, 2026First seen by HOL Aug 5, 2026Material review Sep 14, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 8.8
Exploitation: Not marked as known exploited
Affected software: 6 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Affected products and reported versions
Product	Affected versions	Fixed versions
cpe:2.3:o:linux:linux_kernel::::::::	Not reported	Not reported
cpe:2.3:o:linux:linux_kernel:6.12:rc1::::::	Not reported	Not reported
cpe:2.3:o:linux:linux_kernel:6.12:rc2::::::	Not reported	Not reported

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=e07a06b4eb417f5271d33ce2240e93c62d98b7b4 <867639300759e3e1c5b1e1a5ff89231f263a32a7 \|\| >=e07a06b4eb417f5271d33ce2240e93c62d98b7b4 <98ccd44002d88cbf4edfc4480df532a3da5a013e \|\| >=e07a06b4eb417f5271d33ce2240e93c62d98b7b4 <18fd04ad856df07733f5bb07e7f7168e7443d393	867639300759e3e1c5b1e1a5ff89231f263a32a7, 98ccd44002d88cbf4edfc4480df532a3da5a013e, 18fd04ad856df07733f5bb07e7f7168e7443d393
Linux/Linuxgeneric	6.1	Not reported
Linux/Linuxgeneric	>=e07a06b4eb417f5271d33ce2240e93c62d98b7b4 <9b666a0490379c860eab380dec19a864c0bc256b \|\| >=e07a06b4eb417f5271d33ce2240e93c62d98b7b4 <867639300759e3e1c5b1e1a5ff89231f263a32a7 \|\| >=e07a06b4eb417f5271d33ce2240e93c62d98b7b4 <98ccd44002d88cbf4edfc4480df532a3da5a013e \|\| >=e07a06b4eb417f5271d33ce2240e93c62d98b7b4 <18fd04ad856df07733f5bb07e7f7168e7443d393	9b666a0490379c860eab380dec19a864c0bc256b, 867639300759e3e1c5b1e1a5ff89231f263a32a7, 98ccd44002d88cbf4edfc4480df532a3da5a013e, 18fd04ad856df07733f5bb07e7f7168e7443d393

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 867639300759e3e1c5b1e1a5ff89231f263a32a7; Linux/Linux to 9b666a0490379c860eab380dec19a864c0bc256b if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Oct 21, 2024
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Aug 5, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync This checks if the ACL connection remains valid as it could be destroyed while hci_enhanced_setup_sync is pending on cmd_sync leading to the following trace: BUG: KASAN: slab-use-after-free in hci_enhanced_setup_sync+0x91b/0xa60 Read of size 1 at addr ffff888002328ffd by task kworker/u5:2/37 CPU: 0 UID: 0 PID: 37 Comm: kworker/u5:2 Not tainted 6.11.0-rc6-01300-g810be445d8d6 #7099 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ? hci_enhanced_setup_sync+0x91b/0xa60 print_report+0x152/0x4c0 ? hci_enhanced_setup_sync+0x91b/0xa60 ? __virt_addr_valid+0x1fa/0x420 ? hci_enhanced_setup_sync+0x91b/0xa60 kasan_report+0xda/0x1b0 ? hci_enhanced_setup_sync+0x91b/0xa60 hci_enhanced_setup_sync+0x91b/0xa60 ? __pfx_hci_enhanced_setup_sync+0x10/0x10 ? __pfx___mutex_lock+0x10/0x10 hci_cmd_sync_work+0x1c2/0x330 process_one_work+0x7d9/0x1360 ? __pfx_lock_acquire+0x10/0x10 ? __pfx_process_one_work+0x10/0x10 ? assign_work+0x167/0x240 worker_thread+0x5b7/0xf60 ? __kthread_parkme+0xac/0x1c0 ? __pfx_worker_thread+0x10/0x10 ? __pfx_worker_thread+0x10/0x10 kthread+0x293/0x360 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 34: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __hci_conn_add+0x187/0x17d0 hci_connect_sco+0x2e1/0xb90 sco_sock_connect+0x2a2/0xb80 __sys_connect+0x227/0x2a0 __x64_sys_connect+0x6d/0xb0 do_syscall_64+0x71/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 37: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x101/0x160 kfree+0xd0/0x250 device_release+0x9a/0x210 kobject_put+0x151/0x280 hci_conn_del+0x448/0xbf0 hci_abort_conn_sync+0x46f/0x980 hci_cmd_sync_work+0x1c2/0x330 process_one_work+0x7d9/0x1360 worker_thread+0x5b7/0xf60 kthread+0x293/0x360 ret_from_fork+0x2f/0x70 ret_from_fork_asm+0x1a/0x30

Quoted source text, attributed separately from HOL analysis.