CVE-2024-36032

A flaw was found in the Linux kernel's Qualcomm Atheros Bluetooth (QCA) driver. Due to missing validation checks when retrieving firmware build identifiers, a malformed response can leave uninitialized memory in a buffer exposed through the debug filesystem (debugfs). A local user with access to debugfs could exploit this flaw to inspect sensitive kernel stack contents, leading to information disclosure.

This vulnerability is rated as having Low severity for Red Hat because successful exploitation requires local administrative access to debugfs and the presence of physical Qualcomm Atheros Bluetooth hardware. The exposure is limited to disclosing uninitialized kernel memory without granting privilege escalation or causing a denial of service. Additionally, debugfs access is restricted to root by default across Red Hat Enterprise Linux deployments, substantially constraining unprivileged attack vectors.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.