CVE-2024-56605

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()

bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_alloc() frees the sk object, but the dangling pointer is still attached to the sock object, which may create use-after-free in other code.

The bug could happen only for some complex conditions (on error path and during closing connection). It would not be simple to use it for attack, so attack complexity it high. Unlikely that would be possible to trigger it remotely. No known reproducer. The security impact is limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If the Bluetooth not being used, then can be disabled. To mitigate this issue, prevent module bluetooth from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.