CVE-2024-36968

in linux kernel bluetooth L2CAP, l2cap_le_flowctl_init() can cause both div-by-zero and an integer overflow since hdev->le_mtu may not fall in the valid range.

This flaw is rated as Moderate severity because exploitation results exclusively in a kernel denial of service (system crash) with no direct compromise to system confidentiality or integrity. On typical Red Hat Enterprise Linux server installations, Bluetooth hardware and drivers are either not present or disabled by default, significantly limiting exposure. Systems are only vulnerable if an attacker can deliver malformed Low Energy connection parameters to an active Bluetooth interface or emulated HCI device.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.