{"id":"CVE-2024-26886","revision":"8b3dc7e6c3784a709d94e2d16ac3a22b","records":[{"revision":"8b3dc7e6c3784a709d94e2d16ac3a22b","observedAt":"2026-10-30T13:45:33.454+00:00","statement":{"source":"cve-program","id":"CVE-2024-26886","aliases":[],"title":"Bluetooth: af_bluetooth: Fix deadlock","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: af_bluetooth: Fix deadlock\n\nAttemting to do sock_lock on .recvmsg may cause a deadlock as shown\nbellow, so instead of using sock_sock this uses sk_receive_queue.lock\non bt_sock_ioctl to avoid the UAF:\n\nINFO: task kworker/u9:1:121 blocked for more than 30 seconds.\n      Not tainted 6.7.6-lemon #183\nWorkqueue: hci0 hci_rx_work\nCall Trace:\n <TASK>\n __schedule+0x37d/0xa00\n schedule+0x32/0xe0\n __lock_sock+0x68/0xa0\n ? __pfx_autoremove_wake_function+0x10/0x10\n lock_sock_nested+0x43/0x50\n l2cap_sock_recv_cb+0x21/0xa0\n l2cap_recv_frame+0x55b/0x30a0\n ? psi_task_switch+0xeb/0x270\n ? finish_task_switch.isra.0+0x93/0x2a0\n hci_rx_work+0x33a/0x3f0\n process_one_work+0x13a/0x2f0\n worker_thread+0x2f0/0x410\n ? __pfx_worker_thread+0x10/0x10\n kthread+0xe0/0x110\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2c/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1b/0x30\n </TASK>","state":0,"publishedAt":"2024-04-17T10:27:40.941+00:00","modifiedAt":"2026-10-30T12:17:59.005+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/af_bluetooth.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2b16d960c79abc397f102c3d23d30005b68cb036\",\n                            \"lessThan\": \"60673f442984fe689d4127a5dd4be414247b3d67\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"37f71e2c9f515834841826f4eb68ec33cfb2a1ff\",\n                            \"lessThan\": \"0309acebc4b3884bfda332558bb8a1df052f4f39\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1d576c3a5af850bf11fbd103f9ba11aa6d6061fb\",\n                            \"lessThan\": \"64be3c6154886200708da0dfe259705fb992416c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2e07e8348ea454615e268222ae3fc240421be768\",\n                            \"lessThan\": \"817e8138ce86001b2fa5c63d6ede756e205a01f7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2e07e8348ea454615e268222ae3fc240421be768\",\n                            \"lessThan\": \"2c9e2df022ef8b9d7fac58a04a2ef4ed25288955\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2e07e8348ea454615e268222ae3fc240421be768\",\n                            \"lessThan\": \"f7b94bdc1ec107c92262716b073b3e816d4784fb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"db1b14eec8c61a20374de9f9c2ddc6c9406a8c42\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.15.146\",\n                            \"lessThan\": \"5.15.209\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.70\",\n                            \"lessThan\": \"6.1.191\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.9\",\n                            \"lessThan\": \"6.6.23\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.206\",\n                            \"lessThan\": \"5.11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/af_bluetooth.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.209\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.191\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.23\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.7.11\",\n                            \"lessThanOrEqual\": \"6.7.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.8.2\",\n                            \"lessThanOrEqual\": \"6.8.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.9\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/60673f442984fe689d4127a5dd4be414247b3d67","https://git.kernel.org/stable/c/0309acebc4b3884bfda332558bb8a1df052f4f39","https://git.kernel.org/stable/c/64be3c6154886200708da0dfe259705fb992416c","https://git.kernel.org/stable/c/817e8138ce86001b2fa5c63d6ede756e205a01f7","https://git.kernel.org/stable/c/2c9e2df022ef8b9d7fac58a04a2ef4ed25288955","https://git.kernel.org/stable/c/f7b94bdc1ec107c92262716b073b3e816d4784fb"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-26886","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-26886","identifiers":["CVE-2024-26886"]},"retained":false,"historicalAffected":[]}],"coverage":[]}