CVE-2024-35978

This CVE identifies a memory leak in the Linux kernel's Bluetooth subsystem, specifically within the hci_req_sync_complete() function. The issue arises because the function fails to release the previous synchronization request state before assigning a new one, leading to increased memory usage over time. This flaw can degrade system performance and potentially cause a denial of service.

This vulnerability is rated as Moderate impact because exploitation requires local privileges and primarily leads to gradual kernel memory exhaustion rather than privilege escalation or arbitrary code execution. In typical Red Hat Enterprise Linux server environments, Bluetooth hardware is absent or unconfigured, significantly limiting exposure. Consequently, the flaw is restricted to systems actively operating Bluetooth interfaces, where repeated synchronization requests can cause a localized denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.