CVE-2024-57879

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: iso: Always release hdev at the end of iso_listen_bis

Since hci_get_route holds the device before returning, the hdev should be released with hci_dev_put at the end of iso_listen_bis even if the function returns with an error.

This vulnerability is rated as Moderate because exploitation requires local access and an active Bluetooth adapter, limiting the impact to a denial of service via kernel resource exhaustion rather than arbitrary code execution or privilege escalation. Standard Red Hat Enterprise Linux server environments typically do not utilize Bluetooth hardware or load the Bluetooth subsystem by default, significantly reducing real-world exposure. On systems where Bluetooth is active, a local user can trigger this flaw by listening on Bluetooth ISO sockets, causing kernel device reference count leaks that hinder device cleanup.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.