CVE-2024-46749: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-46749 affects the Linux kernel's Bluetooth btnxpuart driver. The vulnerability was discovered when a NULL pointer dereference was identified in the btnxpuart_flush() function. This issue occurs when removing the driver after firmware download fails or before firmware download completes (Kernel Patch).

The vulnerability is a NULL pointer dereference that occurs in the btnxpuartflush() and btnxpuartclose() functions of the Linux kernel's Bluetooth btnxpuart driver. The issue manifests when attempting to free rx->skb without proper NULL pointer checking. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause a kernel crash due to the NULL pointer dereference, leading to a denial of service condition. The issue affects systems running Linux kernel versions up to (excluding) 6.6.51 and versions from (including) 6.7 up to (excluding) 6.10.10 (NVD).

The vulnerability has been fixed by adding proper NULL pointer checking before freeing rx->skb in both flush and close functions. The fix has been implemented in the Linux kernel through patches that add ISERRORNULL checks before attempting to free the rxskb pointer (Kernel Patch).