{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-26890","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-19T14:20:24.186Z","datePublished":"2024-04-17T10:27:43.438Z","dateUpdated":"2026-08-05T11:28:11.662Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:28:11.662Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: fix out of bounds memory access\n\nThe problem is detected by KASAN.\nbtrtl driver uses private hci data to store 'struct btrealtek_data'.\nIf btrtl driver is used with btusb, then memory for private hci data\nis allocated in btusb. But no private data is allocated after hci_dev,\nwhen btrtl is used with hci_h5.\n\nThis commit adds memory allocation for hci_h5 case.\n\n ==================================================================\n BUG: KASAN: slab-out-of-bounds in btrtl_initialize+0x6cc/0x958 [btrtl]\n Write of size 8 at addr ffff00000f5a5748 by task kworker/u9:0/76\n\n Hardware name: Pine64 PinePhone (1.2) (DT)\n Workqueue: hci0 hci_power_on [bluetooth]\n Call trace:\n  dump_backtrace+0x9c/0x128\n  show_stack+0x20/0x38\n  dump_stack_lvl+0x48/0x60\n  print_report+0xf8/0x5d8\n  kasan_report+0x90/0xd0\n  __asan_store8+0x9c/0xc0\n  \t [btrtl]\n  h5_btrtl_setup+0xd0/0x2f8 [hci_uart]\n  h5_setup+0x50/0x80 [hci_uart]\n  hci_uart_setup+0xd4/0x260 [hci_uart]\n  hci_dev_open_sync+0x1cc/0xf68 [bluetooth]\n  hci_dev_do_open+0x34/0x90 [bluetooth]\n  hci_power_on+0xc4/0x3c8 [bluetooth]\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n\n Allocated by task 53:\n  kasan_save_stack+0x3c/0x68\n  kasan_save_track+0x20/0x40\n  kasan_save_alloc_info+0x68/0x78\n  __kasan_kmalloc+0xd4/0xd8\n  __kmalloc+0x1b4/0x3b0\n  hci_alloc_dev_priv+0x28/0xa58 [bluetooth]\n  hci_uart_register_device+0x118/0x4f8 [hci_uart]\n  h5_serdev_probe+0xf4/0x178 [hci_uart]\n  serdev_drv_probe+0x54/0xa0\n  really_probe+0x254/0x588\n  __driver_probe_device+0xc4/0x210\n  driver_probe_device+0x64/0x160\n  __driver_attach_async_helper+0x88/0x158\n  async_run_entry_fn+0xd0/0x388\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n\n Last potentially related work creation:\n  kasan_save_stack+0x3c/0x68\n  __kasan_record_aux_stack+0xb0/0x150\n  kasan_record_aux_stack_noalloc+0x14/0x20\n  __queue_work+0x33c/0x960\n  queue_work_on+0x98/0xc0\n  hci_recv_frame+0xc8/0x1e8 [bluetooth]\n  h5_complete_rx_pkt+0x2c8/0x800 [hci_uart]\n  h5_rx_payload+0x98/0xb8 [hci_uart]\n  h5_recv+0x158/0x3d8 [hci_uart]\n  hci_uart_receive_buf+0xa0/0xe8 [hci_uart]\n  ttyport_receive_buf+0xac/0x178\n  flush_to_ldisc+0x130/0x2c8\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n\n Second to last potentially related work creation:\n  kasan_save_stack+0x3c/0x68\n  __kasan_record_aux_stack+0xb0/0x150\n  kasan_record_aux_stack_noalloc+0x14/0x20\n  __queue_work+0x788/0x960\n  queue_work_on+0x98/0xc0\n  __hci_cmd_sync_sk+0x23c/0x7a0 [bluetooth]\n  __hci_cmd_sync+0x24/0x38 [bluetooth]\n  btrtl_initialize+0x760/0x958 [btrtl]\n  h5_btrtl_setup+0xd0/0x2f8 [hci_uart]\n  h5_setup+0x50/0x80 [hci_uart]\n  hci_uart_setup+0xd4/0x260 [hci_uart]\n  hci_dev_open_sync+0x1cc/0xf68 [bluetooth]\n  hci_dev_do_open+0x34/0x90 [bluetooth]\n  hci_power_on+0xc4/0x3c8 [bluetooth]\n  process_one_work+0x328/0x6f0\n  worker_thread+0x410/0x778\n  kthread+0x168/0x178\n  ret_from_fork+0x10/0x20\n =================================================================="}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The out-of-bounds access happens in the HCI device setup path (`h5_serdev_probe` → `hci_dev_open_sync` → `h5_btrtl_setup` → `btrtl_initialize`), driven entirely by local driver probe/open and locally loaded firmware, before any RF link exists. No network or adjacent-network data reaches the vulnerable code, and the UART-attached controller is a permanently soldered on-board device rather than a hot-plugged one.\nAC:L - The overflow is unconditional and fully deterministic — `sizeof_priv` is zero for every RTL H5 device, so every single `btrtl_initialize()`/`btrtl_download_firmware()` run writes past the end of the `hci_dev` allocation with no race, no timing window, and no memory grooming required. It reproduces on the first attempt on every affected system, as the reported KASAN splat from a stock PinePhone boot shows.\nPR:L - An unprivileged local session user on the affected phone/tablet/laptop class can re-trigger the write at will, because `h5_btrtl_resume()` performs a `device_reprobe()` on RTL8723BS parts and a suspend/resume cycle is permitted to active local sessions by default logind/polkit policy, re-running the full setup path. The write also fires with zero privileges during the automatic boot-time probe; the root/`CAP_NET_ADMIN`-gated `HCIDEVUP` ioctl is only one of several trigger routes, not a required one.\nUI:N - The out-of-bounds write executes in a kernel workqueue during automatic device probe and power-on, with no administrator or victim action of any kind. The suspend/resume re-trigger is initiated by the attacker's own process.\nS:U - The corruption is confined to the kernel slab of the same host and is exploited by, and against, the kernel's own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `btrtl_dmp_hdr()` reads the out-of-bounds `rtl_dump.controller` and `rtl_dump.driver_name` fields back as pointers and `snprintf(\"%s\", ...)`s them into a devcoredump buffer that userspace can read from `/sys/class/devcoredump/`; when that region overlaps a neighbouring slab object whose contents have since changed, this becomes a read of an attacker-influenceable kernel pointer and disclosure of arbitrary kernel memory. The out-of-bounds region also exposes adjacent heap contents to the driver's own logic (`btrealtek_test_flag`, firmware-version reporting).\nI:H - This is a confirmed slab out-of-bounds write (KASAN \"Write of size 8\") of up to 32 bytes — two kernel `.rodata` pointers, a firmware-derived `u32`, and a `set_bit()` — immediately past the `hci_dev` allocation, at a fixed and predictable offset. Depending on kernel version, architecture, and config (`sizeof(struct hci_dev)` relative to the kmalloc bucket, particularly on the 32-bit ARM boards that use this exact driver), those bytes land in the head of the adjacent heap object, giving a repeatable heap-overflow primitive that can be groomed by controlling what occupies the neighbouring slot.\nA:H - Corrupting the first bytes of a neighbouring kmalloc object, and later dereferencing pointers read back out of bounds in `btrtl_dmp_hdr()`, readily produces a kernel oops or panic; the access is repeated on every probe, resume, and device open. On builds with KASAN or arm64 MTE (shipped in production on some Android devices), the very first occurrence is a fatal report/panic, and `panic_on_warn`/`panic_on_oops` hardened embedded and automotive builds turn it into an immediate full system outage."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bluetooth/hci_h5.c"],"versions":[{"version":"5b355944b19011011dd3fd4187444c5ff1d76ad2","lessThan":"dd163fa34c483f1674aa2510accce11a224f649e","status":"affected","versionType":"git"},{"version":"5b355944b19011011dd3fd4187444c5ff1d76ad2","lessThan":"2f232bc389a4f5943c40733582f9edf77b89e499","status":"affected","versionType":"git"},{"version":"5b355944b19011011dd3fd4187444c5ff1d76ad2","lessThan":"0c657e641df1e77d6087688190f632cad9c0439b","status":"affected","versionType":"git"},{"version":"5b355944b19011011dd3fd4187444c5ff1d76ad2","lessThan":"de4e88ec58c4202efd1f02eebb4939bbf6945358","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bluetooth/hci_h5.c"],"versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","status":"unaffected","versionType":"semver"},{"version":"6.6.23","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.11","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8.2","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.23"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.7.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.8.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/dd163fa34c483f1674aa2510accce11a224f649e"},{"url":"https://git.kernel.org/stable/c/2f232bc389a4f5943c40733582f9edf77b89e499"},{"url":"https://git.kernel.org/stable/c/0c657e641df1e77d6087688190f632cad9c0439b"},{"url":"https://git.kernel.org/stable/c/de4e88ec58c4202efd1f02eebb4939bbf6945358"}],"title":"Bluetooth: btrtl: fix out of bounds memory access","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-125","lang":"en","description":"CWE-125 Out-of-bounds Read"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-07-16T15:26:42.807885Z","id":"CVE-2024-26890","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-11-05T15:19:10.562Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T00:21:05.409Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/dd163fa34c483f1674aa2510accce11a224f649e","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/2f232bc389a4f5943c40733582f9edf77b89e499","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/0c657e641df1e77d6087688190f632cad9c0439b","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/de4e88ec58c4202efd1f02eebb4939bbf6945358","tags":["x_transferred"]}]}]}}