CVE-2024-41062: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-41062 affects the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) subsystem. The vulnerability was discovered and reported on July 29, 2024, and involves a race condition between sock closure and data reception in the Bluetooth L2CAP implementation (Kernel Git).

The vulnerability occurs due to a race condition between the system call to close the sock and hci_rx_work, where the former releases the sock and the latter accesses it without proper lock protection. The issue manifests in the following execution sequence: sock_close/l2cap_sock_release/l2cap_sock_kill/sk_free on one CPU while hci_rx_work/hci_acldata_packet/l2cap_recv_frame/l2cap_conless_channel/l2cap_sock_recv_cb executes on another CPU (Kernel Git).

If hci_rx_work processes the data after the sock is closed, the work thread may access the released sock when receiving data, potentially leading to memory corruption or system instability (Kernel Git).

The vulnerability was discovered and tested by the Syzkaller automated testing system, as indicated by the reported-and-tested-by tag in the patch (Kernel Git).

The issue has been fixed by adding a chan mutex in the rx callback of the sock to achieve synchronization between the sock release and recv cb. Additionally, when the sock is dead, the chan data is set to NULL to prevent others from using an invalid sock pointer. The fix has been implemented in various Linux kernel versions including 6.8.0-48.48 for Ubuntu 24.04 LTS (Ubuntu Security).