CVE-2024-27399: 
Linux Kernel vulnerability analysis and mitigation

A race condition vulnerability was discovered in the Linux kernel's Bluetooth L2CAP implementation (CVE-2024-27399). The issue exists between l2cap_chan_timeout() and l2cap_chan_del() functions, where when l2cap_chan_del() is used to delete a channel, the chan->conn is set to null but could be dereferenced again in the mutex_lock() of l2cap_chan_timeout(), resulting in a null pointer dereference (Kernel Git).

The vulnerability stems from a race condition in the Linux kernel's Bluetooth L2CAP subsystem. When l2cap_chan_del() deletes a channel, it sets chan->conn to null. However, l2cap_chan_timeout() can still attempt to access this null pointer when calling mutex_lock() on the connection's lock, leading to a kernel null pointer dereference. This was confirmed through KASAN (Kernel Address Sanitizer) reports showing a null pointer dereference at address 0x158 during mutex_lock operations (Kernel Git).

When successfully exploited, this vulnerability can lead to a Denial of Service (DoS) condition in the Linux kernel. The vulnerability has been assigned a CVSS v3.1 score of 5.5 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NetApp Advisory).

The vulnerability requires local access and low privileges to exploit. A proof of concept (PoC) exists that can trigger the null pointer dereference, as demonstrated in the KASAN report included in the original bug report (Kernel Git).

The vulnerability has been fixed by adding a check to verify whether conn is null in l2cap_chan_timeout() before attempting to access it. The fix has been incorporated into various Linux kernel versions and distributions. Major Linux distributions like Fedora and Debian have released patches to address this vulnerability (Fedora Update, Debian Update).