CVE-2024-26886

medium

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: af_bluetooth: Fix deadlock Attemting to do sock_lock on .recvmsg may cause a d…

Vendor / product: Linux — linux kernel

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: af_bluetooth: Fix deadlock Attemting to do sock_lock on .recvmsg may cause a deadlock as shown bellow, so instead of using sock_sock this uses sk_receive_queue.lock on bt_sock_ioctl to avoid the UAF: INFO: task kworker/u9:1:121 blocked for more than 30 seconds. Not tainted 6.7.6-lemon #183 Workqueue: hci0 hci_rx_work Call Trace: __schedule+0x37d/0xa00 schedule+0x32/0xe0 __lock_sock+0x68/0xa0 ? __pfx_autoremove_wake_function+0x10/0x10 lock_sock_nested+0x43/0x50 l2cap_sock_recv_cb+0x21/0xa0 l2cap_recv_frame+0x55b/0x30a0 ? psi_task_switch+0xeb/0x270 ? finish_task_switch.isra.0+0x93/0x2a0 hci_rx_work+0x33a/0x3f0 process_one_work+0x13a/0x2f0 worker_thread+0x2f0/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xe0/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30

CVSS

6.5

6.5 (CVSS v3.1)

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity source: NVD CVSS v3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Timeline (UTC)

Published: 2024-04-17 11:15

Modified: 2026-10-30 13:17

NVD status: Modified

Last synced 3 days ago

Verified against the source API 2026-10-30 13:38 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

linux / linux_kernel ≥5.10.206 <5.11, ≥5.15.146 <5.16, ≥6.1.70 <6.1.83, ≥6.6.9 <6.6.23, ≥6.7 <6.7.11, ≥6.8 <6.8.2

Weakness classification (CWE)

CWE-416

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Patch / mitigation: https://git.kernel.org/stable/c/2c9e2df022ef8b9d7fac58a04a2ef4ed25288955

Patch / mitigation: https://git.kernel.org/stable/c/64be3c6154886200708da0dfe259705fb992416c

Patch / mitigation: https://git.kernel.org/stable/c/817e8138ce86001b2fa5c63d6ede756e205a01f7

Patch / mitigation: https://git.kernel.org/stable/c/f7b94bdc1ec107c92262716b073b3e816d4784fb

Patch / mitigation: https://git.kernel.org/stable/c/2c9e2df022ef8b9d7fac58a04a2ef4ed25288955

Patch / mitigation: https://git.kernel.org/stable/c/64be3c6154886200708da0dfe259705fb992416c

Patch / mitigation: https://git.kernel.org/stable/c/817e8138ce86001b2fa5c63d6ede756e205a01f7

Patch / mitigation: https://git.kernel.org/stable/c/cb8adca52f306563d958a863bb0cbae9c184d1ae

Patch / mitigation: https://git.kernel.org/stable/c/f7b94bdc1ec107c92262716b073b3e816d4784fb

References

https://git.kernel.org/stable/c/0309acebc4b3884bfda332558bb8a1df052f4f39 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2c9e2df022ef8b9d7fac58a04a2ef4ed25288955 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/60673f442984fe689d4127a5dd4be414247b3d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/64be3c6154886200708da0dfe259705fb992416c 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/817e8138ce86001b2fa5c63d6ede756e205a01f7 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f7b94bdc1ec107c92262716b073b3e816d4784fb 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2c9e2df022ef8b9d7fac58a04a2ef4ed25288955 af854a3a-2127-422b-91ae-364da2661108
https://git.kernel.org/stable/c/64be3c6154886200708da0dfe259705fb992416c af854a3a-2127-422b-91ae-364da2661108
https://git.kernel.org/stable/c/817e8138ce86001b2fa5c63d6ede756e205a01f7 af854a3a-2127-422b-91ae-364da2661108
https://git.kernel.org/stable/c/cb8adca52f306563d958a863bb0cbae9c184d1ae af854a3a-2127-422b-91ae-364da2661108
https://git.kernel.org/stable/c/f7b94bdc1ec107c92262716b073b3e816d4784fb af854a3a-2127-422b-91ae-364da2661108

Data sources

NVD CVE API 2.0 — fetched 2026-10-30 13:38 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2024-26886

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs