{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-58238","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:19:43.804Z","datePublished":"2025-08-09T14:31:47.079Z","dateUpdated":"2026-08-05T11:47:48.070Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:47:48.070Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart: Resolve TX timeout error in power save stress test\n\nThis fixes the tx timeout issue seen while running a stress test on\nbtnxpuart for couple of hours, such that the interval between two HCI\ncommands coincide with the power save timeout value of 2 seconds.\n\nTest procedure using bash script:\n<load btnxpuart.ko>\nhciconfig hci0 up\n//Enable Power Save feature\nhcitool -i hci0 cmd 3f 23 02 00 00\nwhile (true)\ndo\n    hciconfig hci0 leadv\n    sleep 2\n    hciconfig hci0 noleadv\n    sleep 2\ndone\n\nError log, after adding few more debug prints:\nBluetooth: btnxpuart_queue_skb(): 01 0A 20 01 00\nBluetooth: hci0: Set UART break: on, status=0\nBluetooth: hci0: btnxpuart_tx_wakeup() tx_work scheduled\nBluetooth: hci0: btnxpuart_tx_work() dequeue: 01 0A 20 01 00\nCan't set advertise mode on hci0: Connection timed out (110)\nBluetooth: hci0: command 0x200a tx timeout\n\nWhen the power save mechanism turns on UART break, and btnxpuart_tx_work()\nis scheduled simultaneously, psdata->ps_state is read as PS_STATE_AWAKE,\nwhich prevents the psdata->work from being scheduled, which is responsible\nto turn OFF UART break.\n\nThis issue is fixed by adding a ps_lock mutex around UART break on/off as\nwell as around ps_state read/write.\nbtnxpuart_tx_wakeup() will now read updated ps_state value. If ps_state is\nPS_STATE_SLEEP, it will first schedule psdata->work, and then it will\nreschedule itself once UART break has been turned off and ps_state is\nPS_STATE_AWAKE.\n\nTested above script for 50,000 iterations and TX timeout error was not\nobserved anymore."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The affected component is a Bluetooth HCI transport driver, and the race is driven by HCI traffic that an unpaired peer within radio range can generate — inbound frames reset the power-save timer via btnxpuart_receive_buf(), and peer requests force host→controller TX at the chosen instant. Bluetooth reachability is scored as Adjacent.\nAC:L - The attacker controls both sides of the race: their own traffic anchors the power-save timer, whose interval is a fixed 2000 ms constant, and their next request schedules the host TX to coincide with the break assertion. The window spans a sleeping serdev_device_break_ctl() call plus workqueue scheduling latency, and attempts can be repeated indefinitely.\nPR:N - No credentials or pairing on the target are needed — a connectable/advertising device responds to connection requests and L2CAP/ATT requests from any unauthenticated peer, and each response is a host→controller UART write. Power-save mode is a platform configuration precondition, not a privilege the attacker must hold.\nUI:N - The race is triggered purely by the timing of Bluetooth traffic against the driver's internal power-save timer. No local user action is required.\nS:U - The consequences are confined to the kernel Bluetooth driver and its attached controller, within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect only destroys outbound bytes on the host-to-controller UART; nothing is read out of bounds and no kernel memory is exposed to the attacker.\nI:L - Asserting the UART break mid-transmission delivers truncated/garbled HCI frames that desynchronize the controller's H4 framing, and silently drops configuration commands so the controller's state diverges from what the host requested. The corruption is limited and not attacker-directed.\nA:H - HCI commands are lost and time out, so link setup, advertising control, and connection operations fail; with no hdev->cmd_timeout recovery handler the Bluetooth interface is effectively unusable for as long as the attacker sustains the traffic pattern, a repeatable denial of the device's Bluetooth function."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bluetooth/btnxpuart.c"],"versions":[{"version":"689ca16e523278470c38832a3010645a78c544d8","lessThan":"9d5df94ce0e213d5b549633f528f96114c736190","status":"affected","versionType":"git"},{"version":"689ca16e523278470c38832a3010645a78c544d8","lessThan":"e4db90e4eb8d5487098712ffb1048f3fa6d25e98","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bluetooth/btnxpuart.c"],"versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","status":"unaffected","versionType":"semver"},{"version":"6.6.49","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.9","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.6.49"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/9d5df94ce0e213d5b549633f528f96114c736190"},{"url":"https://git.kernel.org/stable/c/e4db90e4eb8d5487098712ffb1048f3fa6d25e98"}],"title":"Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test","x_generator":{"engine":"bippy-1.2.0"}}}}