{"api_version":"1","generated_at":"2026-07-23T15:22:11+00:00","cve":"CVE-2024-26886","urls":{"html":"https://cve.report/CVE-2024-26886","api":"https://cve.report/api/cve/CVE-2024-26886.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2024-26886","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-26886"},"summary":{"title":"Bluetooth: af_bluetooth: Fix deadlock","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: af_bluetooth: Fix deadlock\n\nAttemting to do sock_lock on .recvmsg may cause a deadlock as shown\nbellow, so instead of using sock_sock this uses sk_receive_queue.lock\non bt_sock_ioctl to avoid the UAF:\n\nINFO: task kworker/u9:1:121 blocked for more than 30 seconds.\n      Not tainted 6.7.6-lemon #183\nWorkqueue: hci0 hci_rx_work\nCall Trace:\n <TASK>\n __schedule+0x37d/0xa00\n schedule+0x32/0xe0\n __lock_sock+0x68/0xa0\n ? __pfx_autoremove_wake_function+0x10/0x10\n lock_sock_nested+0x43/0x50\n l2cap_sock_recv_cb+0x21/0xa0\n l2cap_recv_frame+0x55b/0x30a0\n ? psi_task_switch+0xeb/0x270\n ? finish_task_switch.isra.0+0x93/0x2a0\n hci_rx_work+0x33a/0x3f0\n process_one_work+0x13a/0x2f0\n worker_thread+0x2f0/0x410\n ? __pfx_worker_thread+0x10/0x10\n kthread+0xe0/0x110\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2c/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1b/0x30\n </TASK>","state":"PUBLISHED","assigner":"Linux","published_at":"2024-04-17 11:15:10","updated_at":"2026-06-01 17:16:28"},"problem_types":["CWE-416","CWE-416 CWE-416 Use After Free"],"metrics":[{"version":"3.1","source":"ADP","type":"DECLARED","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}}],"references":[{"url":"https://git.kernel.org/stable/c/f7b94bdc1ec107c92262716b073b3e816d4784fb","name":"https://git.kernel.org/stable/c/f7b94bdc1ec107c92262716b073b3e816d4784fb","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/817e8138ce86001b2fa5c63d6ede756e205a01f7","name":"https://git.kernel.org/stable/c/817e8138ce86001b2fa5c63d6ede756e205a01f7","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/cb8adca52f306563d958a863bb0cbae9c184d1ae","name":"https://git.kernel.org/stable/c/cb8adca52f306563d958a863bb0cbae9c184d1ae","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2c9e2df022ef8b9d7fac58a04a2ef4ed25288955","name":"https://git.kernel.org/stable/c/2c9e2df022ef8b9d7fac58a04a2ef4ed25288955","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/60673f442984fe689d4127a5dd4be414247b3d67","name":"https://git.kernel.org/stable/c/60673f442984fe689d4127a5dd4be414247b3d67","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/64be3c6154886200708da0dfe259705fb992416c","name":"https://git.kernel.org/stable/c/64be3c6154886200708da0dfe259705fb992416c","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26886","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26886","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2b16d960c79abc397f102c3d23d30005b68cb036 60673f442984fe689d4127a5dd4be414247b3d67 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1d576c3a5af850bf11fbd103f9ba11aa6d6061fb 64be3c6154886200708da0dfe259705fb992416c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2e07e8348ea454615e268222ae3fc240421be768 817e8138ce86001b2fa5c63d6ede756e205a01f7 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2e07e8348ea454615e268222ae3fc240421be768 2c9e2df022ef8b9d7fac58a04a2ef4ed25288955 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2e07e8348ea454615e268222ae3fc240421be768 f7b94bdc1ec107c92262716b073b3e816d4784fb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected db1b14eec8c61a20374de9f9c2ddc6c9406a8c42 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 37f71e2c9f515834841826f4eb68ec33cfb2a1ff git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.15.146 5.15.209 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.6.9 6.6.23 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.10.206 5.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.1.70 6.2 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.7","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.7 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.209 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.23 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.7.11 6.7.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.8.2 6.8.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.9 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2024","cve_id":"26886","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2024-26886","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-06-17T17:41:20.868479Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","description":"CWE-416 Use After Free","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2024-12-04T17:57:18.191Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2024-08-02T00:21:04.229Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/cb8adca52f306563d958a863bb0cbae9c184d1ae"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/64be3c6154886200708da0dfe259705fb992416c"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/817e8138ce86001b2fa5c63d6ede756e205a01f7"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/2c9e2df022ef8b9d7fac58a04a2ef4ed25288955"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/f7b94bdc1ec107c92262716b073b3e816d4784fb"}],"title":"CVE Program Container"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/af_bluetooth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"60673f442984fe689d4127a5dd4be414247b3d67","status":"affected","version":"2b16d960c79abc397f102c3d23d30005b68cb036","versionType":"git"},{"lessThan":"64be3c6154886200708da0dfe259705fb992416c","status":"affected","version":"1d576c3a5af850bf11fbd103f9ba11aa6d6061fb","versionType":"git"},{"lessThan":"817e8138ce86001b2fa5c63d6ede756e205a01f7","status":"affected","version":"2e07e8348ea454615e268222ae3fc240421be768","versionType":"git"},{"lessThan":"2c9e2df022ef8b9d7fac58a04a2ef4ed25288955","status":"affected","version":"2e07e8348ea454615e268222ae3fc240421be768","versionType":"git"},{"lessThan":"f7b94bdc1ec107c92262716b073b3e816d4784fb","status":"affected","version":"2e07e8348ea454615e268222ae3fc240421be768","versionType":"git"},{"status":"affected","version":"db1b14eec8c61a20374de9f9c2ddc6c9406a8c42","versionType":"git"},{"status":"affected","version":"37f71e2c9f515834841826f4eb68ec33cfb2a1ff","versionType":"git"},{"lessThan":"5.15.209","status":"affected","version":"5.15.146","versionType":"semver"},{"lessThan":"6.6.23","status":"affected","version":"6.6.9","versionType":"semver"},{"lessThan":"5.11","status":"affected","version":"5.10.206","versionType":"semver"},{"lessThan":"6.2","status":"affected","version":"6.1.70","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/af_bluetooth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.23","versionType":"semver"},{"lessThanOrEqual":"6.7.*","status":"unaffected","version":"6.7.11","versionType":"semver"},{"lessThanOrEqual":"6.8.*","status":"unaffected","version":"6.8.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.9","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.209","versionStartIncluding":"5.15.146","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.23","versionStartIncluding":"6.6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.7.11","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.8.2","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.9","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.206","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.70","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: af_bluetooth: Fix deadlock\n\nAttemting to do sock_lock on .recvmsg may cause a deadlock as shown\nbellow, so instead of using sock_sock this uses sk_receive_queue.lock\non bt_sock_ioctl to avoid the UAF:\n\nINFO: task kworker/u9:1:121 blocked for more than 30 seconds.\n      Not tainted 6.7.6-lemon #183\nWorkqueue: hci0 hci_rx_work\nCall Trace:\n <TASK>\n __schedule+0x37d/0xa00\n schedule+0x32/0xe0\n __lock_sock+0x68/0xa0\n ? __pfx_autoremove_wake_function+0x10/0x10\n lock_sock_nested+0x43/0x50\n l2cap_sock_recv_cb+0x21/0xa0\n l2cap_recv_frame+0x55b/0x30a0\n ? psi_task_switch+0xeb/0x270\n ? finish_task_switch.isra.0+0x93/0x2a0\n hci_rx_work+0x33a/0x3f0\n process_one_work+0x13a/0x2f0\n worker_thread+0x2f0/0x410\n ? __pfx_worker_thread+0x10/0x10\n kthread+0xe0/0x110\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2c/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1b/0x30\n </TASK>"}],"providerMetadata":{"dateUpdated":"2026-06-01T16:04:31.416Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/60673f442984fe689d4127a5dd4be414247b3d67"},{"url":"https://git.kernel.org/stable/c/64be3c6154886200708da0dfe259705fb992416c"},{"url":"https://git.kernel.org/stable/c/817e8138ce86001b2fa5c63d6ede756e205a01f7"},{"url":"https://git.kernel.org/stable/c/2c9e2df022ef8b9d7fac58a04a2ef4ed25288955"},{"url":"https://git.kernel.org/stable/c/f7b94bdc1ec107c92262716b073b3e816d4784fb"}],"title":"Bluetooth: af_bluetooth: Fix deadlock","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2024-26886","datePublished":"2024-04-17T10:27:40.941Z","dateReserved":"2024-02-19T14:20:24.185Z","dateUpdated":"2026-06-01T16:04:31.416Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2024-04-17 11:15:10","lastModifiedDate":"2026-06-01 17:16:28","problem_types":["CWE-416","CWE-416 CWE-416 Use After Free"],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.206","versionEndExcluding":"5.11","matchCriteriaId":"BF2B36A4-0863-4B10-93EA-AA0E9F9A22F0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.146","versionEndExcluding":"5.16","matchCriteriaId":"FAA2E1CA-770E-4B32-875B-D5C8778DB075"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.70","versionEndExcluding":"6.1.83","matchCriteriaId":"A79BE0FB-9E48-4970-B1FA-2455103632EA"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.9","versionEndExcluding":"6.6.23","matchCriteriaId":"8D7CB827-BC7D-4E41-A05A-9860336AB3BC"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.7.11","matchCriteriaId":"9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.8.2","matchCriteriaId":"543A75FF-25B8-4046-A514-1EA8EDD87AB1"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2024","CveId":"26886","Ordinal":"1","Title":"Bluetooth: af_bluetooth: Fix deadlock","CVE":"CVE-2024-26886","Year":"2024"},"notes":[{"CveYear":"2024","CveId":"26886","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: af_bluetooth: Fix deadlock\n\nAttemting to do sock_lock on .recvmsg may cause a deadlock as shown\nbellow, so instead of using sock_sock this uses sk_receive_queue.lock\non bt_sock_ioctl to avoid the UAF:\n\nINFO: task kworker/u9:1:121 blocked for more than 30 seconds.\n      Not tainted 6.7.6-lemon #183\nWorkqueue: hci0 hci_rx_work\nCall Trace:\n <TASK>\n __schedule+0x37d/0xa00\n schedule+0x32/0xe0\n __lock_sock+0x68/0xa0\n ? __pfx_autoremove_wake_function+0x10/0x10\n lock_sock_nested+0x43/0x50\n l2cap_sock_recv_cb+0x21/0xa0\n l2cap_recv_frame+0x55b/0x30a0\n ? psi_task_switch+0xeb/0x270\n ? finish_task_switch.isra.0+0x93/0x2a0\n hci_rx_work+0x33a/0x3f0\n process_one_work+0x13a/0x2f0\n worker_thread+0x2f0/0x410\n ? __pfx_worker_thread+0x10/0x10\n kthread+0xe0/0x110\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2c/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1b/0x30\n </TASK>","Type":"Description","Title":"Bluetooth: af_bluetooth: Fix deadlock"}]}}}