CVE-2024-53237 – This CVE describes a use-after-free vulnerabili... (How to Fix)

Q: What is the severity of CVE-2024-53237?

CVE-2024-53237 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem. When a Bluetooth device is being unregistered, a race condition can cause the kernel to access freed memory, potentially leading to system crashes or arbitrary code execution. This affects Linux systems with Bluetooth functionality enabled.

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem. When a Bluetooth device is being unregistered, a race condition can cause the kernel to access freed memory, potentially leading to system crashes or arbitrary code execution. This affects Linux systems with Bluetooth functionality enabled.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in description; appears to be fixed in kernel 6.12.0-rc4 and related stable branches

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Bluetooth functionality enabled and in use.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to denial of service, or potential arbitrary code execution with kernel privileges resulting in complete system compromise.

🟠

Likely Case

System crash or kernel panic causing denial of service, requiring system reboot.

🟢

If Mitigated

No impact if Bluetooth functionality is disabled or the system is patched.

🌐 Internet-Facing: LOW - Requires local access or Bluetooth proximity; not directly exploitable over internet.

🏢 Internal Only: MEDIUM - Requires local access or Bluetooth proximity; could be exploited by malicious local users or via Bluetooth attacks.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM - Requires triggering specific race condition during Bluetooth device unregistration

Discovered via syzbot fuzzing; exploitation requires local access or Bluetooth proximity to trigger the race condition.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in Linux kernel commits: 0f67ca2a80acf8b207240405b7f72d660665d3df, 27aabf27fd014ae037cc179c61b0bee7cff55b3d, 6894717a1ea363c5a27010ba604f957c309d282d, 7b277bd569bb6a2777f0014f84b4344f444fd49d, 91e2a2e4d1336333804cd31162984f01ad8cc70f

Vendor Advisory: https://git.kernel.org/stable/c/0f67ca2a80acf8b207240405b7f72d660665d3df

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix. 2. Check with your distribution for backported patches. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable Bluetooth

linux

Disable Bluetooth functionality to prevent exploitation

sudo systemctl stop bluetooth
sudo systemctl disable bluetooth
sudo rfkill block bluetooth

🧯 If You Can't Patch

Disable Bluetooth functionality completely
Restrict Bluetooth usage to trusted devices only

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if Bluetooth is active: uname -r && systemctl status bluetooth

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and check dmesg for no related KASAN errors

📡 Detection & Monitoring

Log Indicators:

KASAN reports of use-after-free in device_for_each_child()
Kernel panic logs related to Bluetooth
System crashes during Bluetooth device disconnection

Network Indicators:

Unusual Bluetooth connection/disconnection patterns

SIEM Query:

kernel: *KASAN* AND *device_for_each_child* OR kernel: *Bluetooth* AND *panic*

📊 Metadata

CVE ID: CVE-2024-53237

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: December 27, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-53237, you might also want to check these: