[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2024-26890":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":19,"cwes":20,"cpes":22,"technologies":24,"references":26,"score":31,"epss_score":32,"epss_percentile":33,"is_kev":34,"cisa_kev_date_added":35,"cisa_kev_due_date":35,"cisa_ssvc":36,"attack_mappings":46,"exploits":53},24369,"CVE-2024-26890","EUVD-2024-24152","In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: fix out of bounds memory access\n\nThe problem is detected by KASAN.\nbtrtl driver uses private hci data to store 'struct btrealtek_data'.\nIf btrtl driver is used with btusb, then memory for private hci data\nis allocated in btusb. But no private data is allocated after hci_dev,\nwhen btrtl is used with hci_h5.\n\nThis commit adds memory allocation for hci_h5 case.\n\n ==================================================================\n BUG: KASAN: slab-out-of-bounds in btrtl_initialize+0x6cc\u002F0x958 [btrtl]\n Write of size 8 at addr ffff00000f5a5748 by task kworker\u002Fu9:0\u002F76\n\n Hardware name: Pine64 PinePhone (1.2) (DT)\n Workqueue: hci0 hci_power_on [bluetooth]\n Call trace:\n  dump_backtrace+0x9c\u002F0x128\n  show_stack+0x20\u002F0x38\n  dump_stack_lvl+0x48\u002F0x60\n  print_report+0xf8\u002F0x5d8\n  kasan_report+0x90\u002F0xd0\n  __asan_store8+0x9c\u002F0xc0\n  \t [btrtl]\n  h5_btrtl_setup+0xd0\u002F0x2f8 [hci_uart]\n  h5_setup+0x50\u002F0x80 [hci_uart]\n  hci_uart_setup+0xd4\u002F0x260 [hci_uart]\n  hci_dev_open_sync+0x1cc\u002F0xf68 [bluetooth]\n  hci_dev_do_open+0x34\u002F0x90 [bluetooth]\n  hci_power_on+0xc4\u002F0x3c8 [bluetooth]\n  process_one_work+0x328\u002F0x6f0\n  worker_thread+0x410\u002F0x778\n  kthread+0x168\u002F0x178\n  ret_from_fork+0x10\u002F0x20\n\n Allocated by task 53:\n  kasan_save_stack+0x3c\u002F0x68\n  kasan_save_track+0x20\u002F0x40\n  kasan_save_alloc_info+0x68\u002F0x78\n  __kasan_kmalloc+0xd4\u002F0xd8\n  __kmalloc+0x1b4\u002F0x3b0\n  hci_alloc_dev_priv+0x28\u002F0xa58 [bluetooth]\n  hci_uart_register_device+0x118\u002F0x4f8 [hci_uart]\n  h5_serdev_probe+0xf4\u002F0x178 [hci_uart]\n  serdev_drv_probe+0x54\u002F0xa0\n  really_probe+0x254\u002F0x588\n  __driver_probe_device+0xc4\u002F0x210\n  driver_probe_device+0x64\u002F0x160\n  __driver_attach_async_helper+0x88\u002F0x158\n  async_run_entry_fn+0xd0\u002F0x388\n  process_one_work+0x328\u002F0x6f0\n  worker_thread+0x410\u002F0x778\n  kthread+0x168\u002F0x178\n  ret_from_fork+0x10\u002F0x20\n\n Last potentially related work creation:\n  kasan_save_stack+0x3c\u002F0x68\n  __kasan_record_aux_stack+0xb0\u002F0x150\n  kasan_record_aux_stack_noalloc+0x14\u002F0x20\n  __queue_work+0x33c\u002F0x960\n  queue_work_on+0x98\u002F0xc0\n  hci_recv_frame+0xc8\u002F0x1e8 [bluetooth]\n  h5_complete_rx_pkt+0x2c8\u002F0x800 [hci_uart]\n  h5_rx_payload+0x98\u002F0xb8 [hci_uart]\n  h5_recv+0x158\u002F0x3d8 [hci_uart]\n  hci_uart_receive_buf+0xa0\u002F0xe8 [hci_uart]\n  ttyport_receive_buf+0xac\u002F0x178\n  flush_to_ldisc+0x130\u002F0x2c8\n  process_one_work+0x328\u002F0x6f0\n  worker_thread+0x410\u002F0x778\n  kthread+0x168\u002F0x178\n  ret_from_fork+0x10\u002F0x20\n\n Second to last potentially related work creation:\n  kasan_save_stack+0x3c\u002F0x68\n  __kasan_record_aux_stack+0xb0\u002F0x150\n  kasan_record_aux_stack_noalloc+0x14\u002F0x20\n  __queue_work+0x788\u002F0x960\n  queue_work_on+0x98\u002F0xc0\n  __hci_cmd_sync_sk+0x23c\u002F0x7a0 [bluetooth]\n  __hci_cmd_sync+0x24\u002F0x38 [bluetooth]\n  btrtl_initialize+0x760\u002F0x958 [btrtl]\n  h5_btrtl_setup+0xd0\u002F0x2f8 [hci_uart]\n  h5_setup+0x50\u002F0x80 [hci_uart]\n  hci_uart_setup+0xd4\u002F0x260 [hci_uart]\n  hci_dev_open_sync+0x1cc\u002F0xf68 [bluetooth]\n  hci_dev_do_open+0x34\u002F0x90 [bluetooth]\n  hci_power_on+0xc4\u002F0x3c8 [bluetooth]\n  process_one_work+0x328\u002F0x6f0\n  worker_thread+0x410\u002F0x778\n  kthread+0x168\u002F0x178\n  ret_from_fork+0x10\u002F0x20\n ==================================================================","2024-04-17T11:15:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":17,"attackComplexity":18,"availabilityImpact":18,"privilegesRequired":17,"confidentialityImpact":18},"UNCHANGED","3.1",6.5,"NETWORK","MEDIUM","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:L","NONE","LOW",true,[21],"CWE-125",[23],"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",[25],"Linux Linux Kernel",[27,28,29,30],"https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F0c657e641df1e77d6087688190f632cad9c0439b","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F2f232bc389a4f5943c40733582f9edf77b89e499","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002Fdd163fa34c483f1674aa2510accce11a224f649e","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002Fde4e88ec58c4202efd1f02eebb4939bbf6945358",0.53,0.00605,0.48651,false,null,{"timestamp":37,"automatable":38,"tech_impact":39,"exploitation":40,"cisa_decision":41,"cisa_remediation_timeline":45},"2024-07-16T15:26:42.807885Z","no","partial","none",{"vector":42,"decision":43,"priority":44},"CISAv1\u002FE:N\u002FA:N\u002FT:P\u002FM:H\u002F2026-10-25T19:07:28.795991\u002F","track_star","medium","60D",[47],{"name":48,"source":49,"tactics":50,"technique_id":52},"Exploit Public-Facing Application","attack_vector",[51],"initial-access","T1190",[]]