{"id":"CVE-2024-58009","state":"PUBLISHED","title":"Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc\n\nA NULL sock pointer is passed into l2cap_sock_alloc() when it is called\nfrom l2cap_sock_new_connection_cb() and the error handling paths should\nalso be aware of it.\n\nSeemingly a more elegant solution would be to swap bt_sock_alloc() and\nl2cap_chan_create() calls since they are not interdependent to that moment\nbut then l2cap_chan_create() adds the soon to be deallocated and still\ndummy-initialized channel to the global list accessible by many L2CAP\npaths. The channel would be removed from the list in short period of time\nbut be a bit more straight-forward here and just check for NULL instead of\nchanging the order of function calls.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE static\nanalysis tool.","publishedAt":"2025-02-27T02:12:04.637Z","updatedAt":"2026-10-15T01:01:19.800Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f6ad641646b67f29c7578dcd6c25813c7dcbf51e","status":"affected","lessThan":"a9a7672fc1a0fe18502493936ccb06413ab89ea6","versionType":"git"},{"version":"daa13175a6dea312a76099066cb4cbd4fc959a84","status":"affected","lessThan":"8e605f580a97530e5a3583beea458a3fa4cbefbd","versionType":"git"},{"version":"a8677028dd5123e5e525b8195483994d87123de4","status":"affected","lessThan":"cf601a24120c674cd7c907ea695f92617af6abd0","versionType":"git"},{"version":"bb2f2342a6ddf7c04f9aefbbfe86104cd138e629","status":"affected","lessThan":"297ce7f544aa675b0d136d788cad0710cdfb0785","versionType":"git"},{"version":"8ad09ddc63ace3950ac43db6fbfe25b40f589dd6","status":"affected","lessThan":"245d48c1ba3e7a1779c2f4cbc6f581ddc8a78e22","versionType":"git"},{"version":"61686abc2f3c2c67822aa23ce6f160467ec83d35","status":"affected","lessThan":"691218a50c3139f7f57ffa79fb89d932eda9571e","versionType":"git"},{"version":"7c4f78cdb8e7501e9f92d291a7d956591bf73be9","status":"affected","lessThan":"49c0d55d59662430f1829ae85b969619573d0fa1","versionType":"git"},{"version":"7c4f78cdb8e7501e9f92d291a7d956591bf73be9","status":"affected","lessThan":"5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1","versionType":"git"},{"version":"5.4.287","status":"affected","lessThan":"5.4.291","versionType":"semver"},{"version":"5.10.231","status":"affected","lessThan":"5.10.235","versionType":"semver"},{"version":"5.15.174","status":"affected","lessThan":"5.15.179","versionType":"semver"},{"version":"6.1.120","status":"affected","lessThan":"6.1.129","versionType":"semver"},{"version":"6.6.66","status":"affected","lessThan":"6.6.78","versionType":"semver"},{"version":"6.12.5","status":"affected","lessThan":"6.12.14","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/l2cap_sock.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.13","versionType":"semver"},{"version":"5.4.291","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.235","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.179","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.129","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.78","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.14","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.3","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/l2cap_sock.c"]}],"references":["https://git.kernel.org/stable/c/a9a7672fc1a0fe18502493936ccb06413ab89ea6","https://git.kernel.org/stable/c/8e605f580a97530e5a3583beea458a3fa4cbefbd","https://git.kernel.org/stable/c/cf601a24120c674cd7c907ea695f92617af6abd0","https://git.kernel.org/stable/c/297ce7f544aa675b0d136d788cad0710cdfb0785","https://git.kernel.org/stable/c/245d48c1ba3e7a1779c2f4cbc6f581ddc8a78e22","https://git.kernel.org/stable/c/691218a50c3139f7f57ffa79fb89d932eda9571e","https://git.kernel.org/stable/c/49c0d55d59662430f1829ae85b969619573d0fa1","https://git.kernel.org/stable/c/5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1","https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-784472.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/58xxx/CVE-2024-58009.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-58009","state":"PUBLISHED","datePublished":"2025-02-27T02:12:04.637Z","dateUpdated":"2026-10-15T01:01:19.800Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-02-27T02:10:48.227Z"},"containers":{"cna":{"title":"Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc\n\nA NULL sock pointer is passed into l2cap_sock_alloc() when it is called\nfrom l2cap_sock_new_connection_cb() and the error handling paths should\nalso be aware of it.\n\nSeemingly a more elegant solution would be to swap bt_sock_alloc() and\nl2cap_chan_create() calls since they are not interdependent to that moment\nbut then l2cap_chan_create() adds the soon to be deallocated and still\ndummy-initialized channel to the global list accessible by many L2CAP\npaths. The channel would be removed from the list in short period of time\nbut be a bit more straight-forward here and just check for NULL instead of\nchanging the order of function calls.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE static\nanalysis tool."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f6ad641646b67f29c7578dcd6c25813c7dcbf51e","status":"affected","lessThan":"a9a7672fc1a0fe18502493936ccb06413ab89ea6","versionType":"git"},{"version":"daa13175a6dea312a76099066cb4cbd4fc959a84","status":"affected","lessThan":"8e605f580a97530e5a3583beea458a3fa4cbefbd","versionType":"git"},{"version":"a8677028dd5123e5e525b8195483994d87123de4","status":"affected","lessThan":"cf601a24120c674cd7c907ea695f92617af6abd0","versionType":"git"},{"version":"bb2f2342a6ddf7c04f9aefbbfe86104cd138e629","status":"affected","lessThan":"297ce7f544aa675b0d136d788cad0710cdfb0785","versionType":"git"},{"version":"8ad09ddc63ace3950ac43db6fbfe25b40f589dd6","status":"affected","lessThan":"245d48c1ba3e7a1779c2f4cbc6f581ddc8a78e22","versionType":"git"},{"version":"61686abc2f3c2c67822aa23ce6f160467ec83d35","status":"affected","lessThan":"691218a50c3139f7f57ffa79fb89d932eda9571e","versionType":"git"},{"version":"7c4f78cdb8e7501e9f92d291a7d956591bf73be9","status":"affected","lessThan":"49c0d55d59662430f1829ae85b969619573d0fa1","versionType":"git"},{"version":"7c4f78cdb8e7501e9f92d291a7d956591bf73be9","status":"affected","lessThan":"5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1","versionType":"git"},{"version":"5.4.287","status":"affected","lessThan":"5.4.291","versionType":"semver"},{"version":"5.10.231","status":"affected","lessThan":"5.10.235","versionType":"semver"},{"version":"5.15.174","status":"affected","lessThan":"5.15.179","versionType":"semver"},{"version":"6.1.120","status":"affected","lessThan":"6.1.129","versionType":"semver"},{"version":"6.6.66","status":"affected","lessThan":"6.6.78","versionType":"semver"},{"version":"6.12.5","status":"affected","lessThan":"6.12.14","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/l2cap_sock.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.13","versionType":"semver"},{"version":"5.4.291","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.235","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.179","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.129","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.78","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.14","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.3","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/l2cap_sock.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/a9a7672fc1a0fe18502493936ccb06413ab89ea6"},{"url":"https://git.kernel.org/stable/c/8e605f580a97530e5a3583beea458a3fa4cbefbd"},{"url":"https://git.kernel.org/stable/c/cf601a24120c674cd7c907ea695f92617af6abd0"},{"url":"https://git.kernel.org/stable/c/297ce7f544aa675b0d136d788cad0710cdfb0785"},{"url":"https://git.kernel.org/stable/c/245d48c1ba3e7a1779c2f4cbc6f581ddc8a78e22"},{"url":"https://git.kernel.org/stable/c/691218a50c3139f7f57ffa79fb89d932eda9571e"},{"url":"https://git.kernel.org/stable/c/49c0d55d59662430f1829ae85b969619573d0fa1"},{"url":"https://git.kernel.org/stable/c/5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-23T15:56:32.500Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.287","versionEndExcluding":"5.4.291"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.231","versionEndExcluding":"5.10.235"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.174","versionEndExcluding":"5.15.179"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.120","versionEndExcluding":"6.1.129"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.66","versionEndExcluding":"6.6.78"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.5","versionEndExcluding":"6.12.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.13.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.14"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T19:33:22.791Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:01:19.800Z"},"x_adpType":"supplier"}]}}}