CVE-2024-26801

Summary

CVE-2024-26801 is a vulnerability affecting the Linux kernel's Bluetooth subsystem. During the handling of an HCI_EV_HARDWARE_ERROR event, if the underlying BT controller is not responding, the hci_error_reset function may encounter a use-after-free issue. This can lead to a crash, as observed in a call trace from a ChromeOS device with Intel AX201. The vulnerability arises because the hci_dev reference is freed while still being referenced. To mitigate this issue, a patch has been implemented to hold the reference count on the hci_dev while processing the HCI_EV_HARDWARE_ERROR event.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.