CVE-2024-41063

Q: What is the severity of CVE-2024-41063?

CVE-2024-41063 has a CVSS score of 5.5 (MEDIUM). A race condition vulnerability in the Linux kernel's Bluetooth subsystem can cause a deadlock during device cleanup, leading to denial of service. This affects systems with Bluetooth hardware and the vulnerable kernel versions. Attackers could potentially crash the kernel or cause system instability.

5.5 MEDIUM

📋 TL;DR

A race condition vulnerability in the Linux kernel's Bluetooth subsystem can cause a deadlock during device cleanup, leading to denial of service. This affects systems with Bluetooth hardware and the vulnerable kernel versions. Attackers could potentially crash the kernel or cause system instability.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE; check kernel commit history for vulnerable versions before fixes.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires Bluetooth hardware/functionality to be present and used. Systems without Bluetooth or with it disabled are not vulnerable.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash requiring physical reboot, potentially causing data loss or service disruption.

🟠

Likely Case

Bluetooth subsystem becomes unresponsive, requiring system restart to restore functionality.

🟢

If Mitigated

Minimal impact with proper patching; at worst, temporary Bluetooth service interruption.

🌐 Internet-Facing: LOW - Requires local access or Bluetooth proximity; not directly exploitable over internet.

🏢 Internal Only: MEDIUM - Local attackers or malicious processes could trigger the deadlock to cause denial of service.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering specific race conditions during Bluetooth device cleanup. Discovered through syzbot fuzzing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits: 0d151a103775dd9645c78c97f77d6e2a5298d913, 3f939bd73fed12dddc2a32a76116c19ca47c7678, 48542881997e17b49dc16b93fe910e0cfcf7a9f9, 96600c2e5ee8213dbab5df1617293d8e847bb4fa, 9cfc84b1d464cc024286f42a090718f9067b80ed

Vendor Advisory: https://git.kernel.org/stable/c/0d151a103775dd9645c78c97f77d6e2a5298d913

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Disable Bluetooth

linux

Completely disable Bluetooth functionality to prevent vulnerability trigger

sudo systemctl stop bluetooth
sudo systemctl disable bluetooth
sudo rfkill block bluetooth

🧯 If You Can't Patch

Disable Bluetooth hardware in BIOS/UEFI if not needed
Implement strict access controls to prevent unauthorized local users from accessing Bluetooth functionality

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with distribution's security advisories. Vulnerable if using unpatched kernel with Bluetooth enabled.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits and Bluetooth functionality works without deadlocks during device removal.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
Bluetooth subsystem crash logs
Workqueue deadlock warnings in dmesg

Network Indicators:

Sudden loss of Bluetooth connectivity
Bluetooth devices failing to pair/disconnect

SIEM Query:

source="kernel" AND ("deadlock" OR "workqueue" OR "hci_error_reset" OR "destroy_workqueue")

📊 Metadata

CVE ID: CVE-2024-41063

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-667

Published: July 29, 2024

Last Updated: November 3, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable Bluetooth

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities