CVE-2024-26890

A flaw was found in the Linux kernel's Realtek Bluetooth driver. When a device is configured using specific serial communication protocols, the driver fails to allocate necessary memory for internal operational data. This failure leads to an out-of-bounds memory write, which a local attacker could trigger to cause a system crash and Denial of Service (DoS) or potentially execute arbitrary code.

This vulnerability is rated as Low severity for Red Hat Enterprise Linux because exploitation requires privileged local access alongside specific, uncommon Realtek Bluetooth hardware connected via serial UART. Typical enterprise server deployments and cloud environments do not incorporate UART-interfaced Bluetooth controllers, drastically reducing the likelihood of exposure. Even if such hardware is present, triggering the flaw requires administrative privileges or physical device interaction, limiting the blast radius to a localized denial of service rather than unauthorized privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.