CVE-2024-56654

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating

The usage of rcu_read_(un)lock while inside list_for_each_entry_rcu is not safe since for the most part entries fetched this way shall be treated as rcu_dereference:

Note that the value returned by rcu_dereference() is valid
only within the enclosing RCU read-side critical section [1]_.
For example, the following is **not** legal::

	rcu_read_lock();
	p = rcu_dereference(head.next);
	rcu_read_unlock();
	x = p->address;	/* BUG!!! */
	rcu_read_lock();
	y = p->data;	/* BUG!!! */
	rcu_read_unlock();

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires local access and is limited to causing a denial of service (kernel crash) without compromising system confidentiality or integrity. The issue resides in the kernel's Bluetooth HCI event handling logic, where improper RCU synchronization during list traversal can result in invalid memory dereferences. In standard enterprise server environments, Bluetooth hardware and services are generally unconfigured or absent by default, substantially reducing exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.