CVE-2024-27398

A flaw was found in the Linux kernel's Bluetooth subsystem. When closing a Synchronous Connection-Oriented (SCO) socket, a race condition between socket cleanup and a delayed timeout worker can cause the kernel to reference memory that has already been released. A local user could exploit this use-after-free vulnerability to crash the system, resulting in a Denial of Service (DoS), or potentially execute arbitrary code.

This vulnerability is rated as having a Low impact for Red Hat Enterprise Linux because exploitation requires local access and an active Bluetooth subsystem, which is rarely utilized or enabled in typical enterprise server environments. The issue stems from a timing conflict during SCO connection teardown that allows a delayed timeout handler to access freed socket memory, presenting predominantly a local denial-of-service risk via kernel crash. Furthermore, unprivileged users do not routinely interact with Bluetooth audio or SCO connections in production deployments, substantially limiting real-world exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.