CVE-2024-53238— Bluetooth: btmtk: adjust the position to init iso data anchor
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于Bluetooth:btmtk模块中iso数据锚点初始化位置不当。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1499 · Endpoint Denial of ServiceAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | ceac1cb0259de682d78f5c784ef8e0b13022e9d9< d8bd79f0eea9c07d90ce870a714ab5c10afaa4b3 |
affected |
ceac1cb0259de682d78f5c784ef8e0b13022e9d9< 1219c211ccd061cde002cc5708692efca515a7a0 |
affected | ||
ceac1cb0259de682d78f5c784ef8e0b13022e9d9< 61c5a3def90ac729a538e5ca5ff7f461cff72776 |
affected | ||
6.11 |
affected | ||
< 6.11 |
unaffected | ||
6.11.11≤ 6.11.* |
unaffected | ||
6.12.2≤ 6.12.* |
unaffected | ||
6.13≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-53238
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bluetooth: btmtk: adjust the position to init iso data anchor
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btmtk: adjust the position to init iso data anchor
MediaTek iso data anchor init should be moved to where MediaTek
claims iso data interface.
If there is an unexpected BT usb disconnect during setup flow,
it will cause a NULL pointer crash issue when releasing iso
anchor since the anchor wasn't been init yet. Adjust the position
to do iso data anchor init.
[ 17.137991] pc : usb_kill_anchored_urbs+0x60/0x168
[ 17.137998] lr : usb_kill_anchored_urbs+0x44/0x168
[ 17.137999] sp : ffffffc0890cb5f0
[ 17.138000] x29: ffffffc0890cb5f0 x28: ffffff80bb6c2e80
[ 17.144081] gpio gpiochip0: registered chardev handle for 1 lines
[ 17.148421] x27: 0000000000000000
[ 17.148422] x26: ffffffd301ff4298 x25: 0000000000000003 x24: 00000000000000f0
[ 17.148424] x23: 0000000000000000 x22: 00000000ffffffff x21: 0000000000000001
[ 17.148425] x20: ffffffffffffffd8 x19: ffffff80c0f25560 x18: 0000000000000000
[ 17.148427] x17: ffffffd33864e408 x16: ffffffd33808f7c8 x15: 0000000000200000
[ 17.232789] x14: e0cd73cf80ffffff x13: 50f2137c0a0338c9 x12: 0000000000000001
[ 17.239912] x11: 0000000080150011 x10: 0000000000000002 x9 : 0000000000000001
[ 17.247035] x8 : 0000000000000000 x7 : 0000000000008080 x6 : 8080000000000000
[ 17.254158] x5 : ffffffd33808ebc0 x4 : fffffffe033dcf20 x3 : 0000000080150011
[ 17.261281] x2 : ffffff8087a91400 x1 : 0000000000000000 x0 : ffffff80c0f25588
[ 17.268404] Call trace:
[ 17.270841] usb_kill_anchored_urbs+0x60/0x168
[ 17.275274] btusb_mtk_release_iso_intf+0x2c/0xd8 [btusb (HASH:5afe 6)]
[ 17.284226] btusb_mtk_disconnect+0x14/0x28 [btusb (HASH:5afe 6)]
[ 17.292652] btusb_disconnect+0x70/0x140 [btusb (HASH:5afe 6)]
[ 17.300818] usb_unbind_interface+0xc4/0x240
[ 17.305079] device_release_driver_internal+0x18c/0x258
[ 17.310296] device_release_driver+0x1c/0x30
[ 17.314557] bus_remove_device+0x140/0x160
[ 17.318643] device_del+0x1c0/0x330
[ 17.322121] usb_disable_device+0x80/0x180
[ 17.326207] usb_disconnect+0xec/0x300
[ 17.329948] hub_quiesce+0x80/0xd0
[ 17.333339] hub_disconnect+0x44/0x190
[ 17.337078] usb_unbind_interface+0xc4/0x240
[ 17.341337] device_release_driver_internal+0x18c/0x258
[ 17.346551] device_release_driver+0x1c/0x30
[ 17.350810] usb_driver_release_interface+0x70/0x88
[ 17.355677] proc_ioctl+0x13c/0x228
[ 17.359157] proc_ioctl_default+0x50/0x80
[ 17.363155] usbdev_ioctl+0x830/0xd08
[ 17.366808] __arm64_sys_ioctl+0x94/0xd0
[ 17.370723] invoke_syscall+0x6c/0xf8
[ 17.374377] el0_svc_common+0x84/0xe0
[ 17.378030] do_el0_svc+0x20/0x30
[ 17.381334] el0_svc+0x34/0x60
[ 17.384382] el0t_64_sync_handler+0x88/0xf0
[ 17.388554] el0t_64_sync+0x180/0x188
[ 17.392208] Code: f9400677 f100a2f4 54fffea0 d503201f (b8350288)
[ 17.398289] ---[ end trace 0000000000000000 ]---
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于Bluetooth:btmtk模块中iso数据锚点初始化位置不当。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-53238
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-53238
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-53238 (3)
Same Patch Batch · Linux · 2024-12-27 · 221 CVEs total
| CVE-2024-56640 | 9.8 CRITICAL | net/smc: fix LGR and link use-after-free issue |
| CVE-2024-53209 | 9.8 CRITICAL | bnxt_en: Fix receive ring space parameters when XDP is active |
| CVE-2024-53206 | 9.8 CRITICAL | tcp: Fix use-after-free of nreq in reqsk_timer_handler(). |
| CVE-2024-53169 | 9.8 CRITICAL | nvme-fabrics: fix kernel crash while shutting down controller |
| CVE-2024-53186 | 9.8 CRITICAL | ksmbd: fix use-after-free in SMB request handling |
| CVE-2024-56645 | 9.8 CRITICAL | can: j1939: j1939_session_new(): fix skb reference counting |
| CVE-2024-53179 | 9.8 CRITICAL | smb: client: fix use-after-free of signing key |
| CVE-2024-56656 | 9.8 CRITICAL | bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips |
| CVE-2024-53177 | 9.8 CRITICAL | smb: prevent use-after-free due to open_cached_dir error paths |
| CVE-2024-53176 | 9.8 CRITICAL | smb: During unmount, ensure all cached dir instances drop their dentry |
| CVE-2024-56653 | 8.8 HIGH | Bluetooth: btmtk: avoid UAF in btmtk_process_coredump |
| CVE-2024-53237 | 8.8 HIGH | Bluetooth: fix use-after-free in device_for_each_child() |
| CVE-2024-53224 | 8.8 HIGH | RDMA/mlx5: Move events notifier registration to be after device registration |
| CVE-2024-56669 | 8.8 HIGH | iommu/vt-d: Remove cache tags before disabling ATS |
| CVE-2024-56626 | 8.8 HIGH | ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write |
| CVE-2024-56591 | 8.8 HIGH | Bluetooth: hci_conn: Use disable_delayed_work_sync |
| CVE-2024-56651 | 8.8 HIGH | can: hi311x: hi3110_can_ist(): fix potential use-after-free |
| CVE-2024-56627 | 8.1 HIGH | ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read |
| CVE-2024-56652 | 7.8 HIGH | drm/xe/reg_sr: Remove register pool |
| CVE-2024-56606 | 7.8 HIGH | af_packet: avoid erroring out after sock_init_data() in packet_create() |
Showing top 20 of 221 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
Same vendor: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
V. Comments for CVE-2024-53238
No comments yet