Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device. Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
65f53e9802dbfae0e5758a91793c3f5f8bece49b to < 390b5db3ff8745187f094c4e915663b7b1f98944affected65f53e9802dbfae0e5758a91793c3f5f8bece49b to < 46a88784c4c9b96954dd86f747ce93f65efa1302affected65f53e9802dbfae0e5758a91793c3f5f8bece49b to < 551ae773ec64045b4e72099132654887e0270bccaffected65f53e9802dbfae0e5758a91793c3f5f8bece49b to < ae215c5b6422d8eda443b861b124bd1be6969c31affected65f53e9802dbfae0e5758a91793c3f5f8bece49b to < df22adc7eafc22e651561813c11dc51a796b12eeaffected65f53e9802dbfae0e5758a91793c3f5f8bece49b to < a6b22dbd80926556290ad2243be25218d6956a19affected65f53e9802dbfae0e5758a91793c3f5f8bece49b to < 563a8573047182f550b1e1e030615755cd8c41daaffected65f53e9802dbfae0e5758a91793c3f5f8bece49b to < bb067a99a0356196c0b89a95721985485ebce5a5affected
Linux Linux
Default version status: affected
3.13affected0 to < 3.13unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.96 to ≤ 6.12.*unaffected6.18.39 to ≤ 6.18.*unaffected7.1.4 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/390b5db3ff8745187f094c4e915663b7b1f98944 ↗
- https://git.kernel.org/stable/c/46a88784c4c9b96954dd86f747ce93f65efa1302 ↗
- https://git.kernel.org/stable/c/551ae773ec64045b4e72099132654887e0270bcc ↗
- https://git.kernel.org/stable/c/ae215c5b6422d8eda443b861b124bd1be6969c31 ↗
- https://git.kernel.org/stable/c/df22adc7eafc22e651561813c11dc51a796b12ee ↗
- https://git.kernel.org/stable/c/a6b22dbd80926556290ad2243be25218d6956a19 ↗
- https://git.kernel.org/stable/c/563a8573047182f550b1e1e030615755cd8c41da ↗
- https://git.kernel.org/stable/c/bb067a99a0356196c0b89a95721985485ebce5a5 ↗