CVE-2024-26890: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26890 is a vulnerability in the Linux kernel's Bluetooth btrtl driver that was discovered in early 2024. The issue involves an out-of-bounds memory access in the btrtl driver when used with hci_h5. The vulnerability occurs because the btrtl driver uses private HCI data to store 'struct btrealtek_data', but when used with hci_h5, no private data is allocated after hci_dev (Kernel Commit).

The vulnerability was detected by KASAN (Kernel Address Sanitizer) as a slab-out-of-bounds write of size 8 in the btrtl_initialize function. The issue manifests when the btrtl driver is used with hci_h5 instead of btusb, where memory for private HCI data is typically allocated. The CVSS v3.1 base score for this vulnerability is 6.5 (MEDIUM) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L (CISA-ADP).

The vulnerability could lead to out-of-bounds memory access in the Linux kernel's Bluetooth subsystem. This could potentially result in system crashes, information leaks, or denial of service conditions when exploited (NVD).

The vulnerability requires the attacker to have access to a system running the affected Linux kernel version with the btrtl Bluetooth driver being used with hci_h5. No known exploits in the wild have been reported at the time of assessment (Kernel Commit).

The issue has been fixed in the Linux kernel through a patch that adds memory allocation for the hci_h5 case. The fix involves adding the sizeof_priv parameter to the h5_vnd rtl_vnd structure to properly allocate memory for the btrealtek_data structure. Users should update their Linux kernel to a version containing this fix (Kernel Commit).