{"id":"DEBIAN-CVE-2024-53237","details":"In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: fix use-after-free in device_for_each_child()  Syzbot has reported the following KASAN splat:  BUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0 Read of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980  CPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 Call Trace:  \u003cTASK\u003e  dump_stack_lvl+0x100/0x190  ? device_for_each_child+0x18f/0x1a0  print_report+0x13a/0x4cb  ? __virt_addr_valid+0x5e/0x590  ? __phys_addr+0xc6/0x150  ? device_for_each_child+0x18f/0x1a0  kasan_report+0xda/0x110  ? device_for_each_child+0x18f/0x1a0  ? __pfx_dev_memalloc_noio+0x10/0x10  device_for_each_child+0x18f/0x1a0  ? __pfx_device_for_each_child+0x10/0x10  pm_runtime_set_memalloc_noio+0xf2/0x180  netdev_unregister_kobject+0x1ed/0x270  unregister_netdevice_many_notify+0x123c/0x1d80  ? __mutex_trylock_common+0xde/0x250  ? __pfx_unregister_netdevice_many_notify+0x10/0x10  ? trace_contention_end+0xe6/0x140  ? __mutex_lock+0x4e7/0x8f0  ? __pfx_lock_acquire.part.0+0x10/0x10  ? rcu_is_watching+0x12/0xc0  ? unregister_netdev+0x12/0x30  unregister_netdevice_queue+0x30d/0x3f0  ? __pfx_unregister_netdevice_queue+0x10/0x10  ? __pfx_down_write+0x10/0x10  unregister_netdev+0x1c/0x30  bnep_session+0x1fb3/0x2ab0  ? __pfx_bnep_session+0x10/0x10  ? __pfx_lock_release+0x10/0x10  ? __pfx_woken_wake_function+0x10/0x10  ? __kthread_parkme+0x132/0x200  ? __pfx_bnep_session+0x10/0x10  ? kthread+0x13a/0x370  ? __pfx_bnep_session+0x10/0x10  kthread+0x2b7/0x370  ? __pfx_kthread+0x10/0x10  ret_from_fork+0x48/0x80  ? __pfx_kthread+0x10/0x10  ret_from_fork_asm+0x1a/0x30  \u003c/TASK\u003e  Allocated by task 4974:  kasan_save_stack+0x30/0x50  kasan_save_track+0x14/0x30  __kasan_kmalloc+0xaa/0xb0  __kmalloc_noprof+0x1d1/0x440  hci_alloc_dev_priv+0x1d/0x2820  __vhci_create_device+0xef/0x7d0  vhci_write+0x2c7/0x480  vfs_write+0x6a0/0xfc0  ksys_write+0x12f/0x260  do_syscall_64+0xc7/0x250  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Freed by task 4979:  kasan_save_stack+0x30/0x50  kasan_save_track+0x14/0x30  kasan_save_free_info+0x3b/0x60  __kasan_slab_free+0x4f/0x70  kfree+0x141/0x490  hci_release_dev+0x4d9/0x600  bt_host_release+0x6a/0xb0  device_release+0xa4/0x240  kobject_put+0x1ec/0x5a0  put_device+0x1f/0x30  vhci_release+0x81/0xf0  __fput+0x3f6/0xb30  task_work_run+0x151/0x250  do_exit+0xa79/0x2c30  do_group_exit+0xd5/0x2a0  get_signal+0x1fcd/0x2210  arch_do_signal_or_restart+0x93/0x780  syscall_exit_to_user_mode+0x140/0x290  do_syscall_64+0xd4/0x250  entry_SYSCALL_64_after_hwframe+0x77/0x7f  In 'hci_conn_del_sysfs()', 'device_unregister()' may be called when an underlying (kobject) reference counter is greater than 1. This means that reparenting (happened when the device is actually freed) is delayed and, during that delay, parent controller device (hciX) may be deleted. Since the latter may create a dangling pointer to freed parent, avoid that scenario by reparenting to NULL explicitly.","modified":"2026-09-15T09:03:16.322622081Z","published":"2024-12-27T14:15:32.130Z","upstream":["CVE-2024-53237"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-53237"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.123-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-53237.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-53237.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-53237.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}