CVE-2024-49950 – A use-after-free vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2024-49950?

CVE-2024-49950 has a CVSS score of 7.8 (HIGH). A use-after-free vulnerability in the Linux kernel's Bluetooth L2CAP implementation allows attackers to potentially execute arbitrary code or crash the system. This affects Linux systems with Bluetooth enabled, particularly those handling Bluetooth connections from untrusted devices.

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's Bluetooth L2CAP implementation allows attackers to potentially execute arbitrary code or crash the system. This affects Linux systems with Bluetooth enabled, particularly those handling Bluetooth connections from untrusted devices.

💻 Affected Systems

Products:

Linux kernel

Versions: Versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Bluetooth enabled and configured. Kernel versions containing the fix commits are safe.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to full system compromise, privilege escalation, or persistent access.

🟠

Likely Case

Kernel panic or system crash causing denial of service.

🟢

If Mitigated

No impact if Bluetooth is disabled or proper access controls prevent untrusted connections.

🌐 Internet-Facing: LOW (Bluetooth is short-range, typically not internet-facing)

🏢 Internal Only: MEDIUM (Requires proximity to vulnerable device with Bluetooth enabled)

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires Bluetooth proximity and knowledge of the vulnerability. The KASAN report suggests it was found through fuzzing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing fix commits: 333b4fd11e89b29c84c269123f871883a30be586, 686e05c9dbd68766c6bda5f31f7e077f36a7fb29, 78d30ce16fdf9c301bcd8b83ce613cea079cea83, a1c6174e23df10b8e5770e82d63bc6e2118a3dc7, b22346eec479a30bfa4a02ad2c551b54809694d0

Vendor Advisory: https://git.kernel.org/stable/c/333b4fd11e89b29c84c269123f871883a30be586

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing fix commits. 2. Reboot system. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable Bluetooth

linux

Completely disable Bluetooth functionality to prevent exploitation

sudo systemctl stop bluetooth
sudo systemctl disable bluetooth
sudo rfkill block bluetooth

Restrict Bluetooth Connections

linux

Configure Bluetooth to only accept connections from trusted devices

sudo btmgmt power off
Configure Bluetooth settings to require pairing/authentication

🧯 If You Can't Patch

Disable Bluetooth completely on affected systems
Implement network segmentation to isolate Bluetooth-enabled devices

🔍 How to Verify

Check if Vulnerable:

Check if Bluetooth is enabled and kernel version is vulnerable: 'systemctl status bluetooth' and 'uname -r'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version after update contains fix commits: 'uname -r' and check kernel changelog

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
Bluetooth connection failures
System crashes related to l2cap_connect

Network Indicators:

Unusual Bluetooth connection attempts
Multiple failed Bluetooth pairing requests

SIEM Query:

source="kernel" AND "KASAN" AND "use-after-free" OR source="bluetooth" AND "l2cap_connect" AND error

📊 Metadata

CVE ID: CVE-2024-49950

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: October 21, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-49950, you might also want to check these: