Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and “UAF”.
Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.
Details
- Affected product:
- AlmaLinux 9.2 ESU , TuxCare 9.6 ESU
- Affected packages:
- kernel @ 5.14.0 (+1 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| AlmaLinux 10 | Released |
22 kernels
|
| AlmaLinux 9 | Released |
78 kernels
|
| AlmaLinux 9.6 ESU | Released |
1 kernel
|
| Debian 12 | Released |
13 kernels
|
| Debian 13 | Will Not Fix | — |
| Oracle Linux 10 | Released |
23 kernels
|
| Oracle Linux 9 | Released |
86 kernels
|
| RHEL 10 | Released |
25 kernels
|
| RHEL 9 | Released |
79 kernels
|
| Rocky Linux 10 | Released |
17 kernels
|
| Rocky Linux 9 | Released |
66 kernels
|
| Ubuntu 24.04 | Released |
34 kernels
|
| Ubuntu 24.04 AWS | Planned | — |