CVE-2024-35856: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35856 is a double-free vulnerability discovered in the Linux kernel's MediaTek Bluetooth USB driver (btusb). The vulnerability was reported by Dan Carpenter and was first disclosed on May 17, 2024. The issue affects Linux kernel versions from 6.6 up to 6.6.30, from 6.7 up to 6.8.9, and various release candidates of version 6.9 (rc1 through rc5) (NVD).

The vulnerability occurs in the btmtk_process_coredump function where hci_devcd_append() would free the skb (socket buffer) on error, causing a potential double free if the caller attempts to free it again. This issue stems from incorrect error handling in the MediaTek Bluetooth USB driver's coredump functionality. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access requirements but high potential impact (NVD).

The vulnerability could potentially lead to memory corruption through a double-free condition, which might result in system crashes, denial of service, or potential code execution. The high CVSS score indicates serious potential consequences for system confidentiality, integrity, and availability (NVD).

The vulnerability requires local access and low privileges to exploit. It specifically affects systems using the MediaTek Bluetooth USB driver with the vulnerable coredump functionality (NVD).

The vulnerability has been fixed through patches in the Linux kernel. The fix involves properly handling the skb free operation in the error path of btmtk_process_coredump. Various Linux distributions have released updates addressing this vulnerability, including Ubuntu 24.04 LTS (noble) with kernel version 6.8.0-40.40 and other affected versions (Ubuntu).