CVE-2024-53237

A flaw was found in the Linux kernel's Bluetooth subsystem. When removing a Bluetooth connection while its parent controller device is being unregistered, improper reference counting can cause the system to retain a reference to memory that has already been released. A local user with administrative privileges could exploit this flaw to trigger a use-after-free condition, leading to a Denial of Service (DoS) through a system crash or potential kernel memory corruption.

This issue is considered to be a moderate impact flaw, as the exploitation for this will need an ADMIN (or ROOT) privilege (PR:H) during unregister netdev.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the Bluetooth kernel module from loading by executing:

echo "install bluetooth /bin/true" > /etc/modprobe.d/disable-bluetooth.conf

If the module is currently loaded, unload it:

modprobe -r bluetooth

Caveats: Disabling the Bluetooth module will completely disable all Bluetooth functionality and associated services across the system.

Warning: If the module is actively in use and cannot be unloaded, a system reboot will be required for the configuration changes to take effect.