UnratedFix available
Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc A NULL sock pointer is passed into l2cap_sock_alloc() when it is called from l2cap_sock_new_connection_cb() and the error handling paths should also be aware of it. Seemingly a more elegant solution would be to swap bt_sock_alloc() and l2cap_chan_create() calls since they are not interdependent to that moment but then l2cap_chan_create() adds the soon to be deallocated and still dummy-initialized channel to the global list accessible by many L2CAP paths. The channel would be removed from the list in short period of time but be a bit more straight-forward here and just check for NULL instead of changing the order of function calls. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.235, 5.15.179, 5.4.291, 6.1.129, 6.12.14, 6.13.3, 6.6.78
- CVEs
- CVE-2024-58009
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 15:47 UTC · Revision 1
Source evidence
Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
core-osv · Original sourcePublished 27 Feb 2025, 02:12 UTC
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc A NULL sock pointer is passed into l2cap_sock_alloc() when it is called from l2cap_sock_new_connection_cb() and the error handling paths should also be aware of it. Seemingly a more elegant solution would be to swap bt_sock_alloc() and l2cap_chan_create() calls since they are not interdependent to that moment but then l2cap_chan_create() adds the soon to be deallocated and still dummy-initialized channel to the global list accessible by many L2CAP paths. The channel would be removed from the list in short period of time but be a bit more straight-forward here and just check for NULL instead of changing the order of function calls. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool.
osv:CVE-2024-58009
Kernel
Fixed versions: 5.4.291, 5.10.235, 5.15.179, 6.1.129, 6.6.78, 6.12.14, 6.13.3
Complete source record
{
"id": "f9964ab7bb7421b57b84bb3183164e26f944b11a76ea397dfb33b55d28ccaedb",
"url": "https://osv.dev/vulnerability/CVE-2024-58009",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc",
"summary": "In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc A NULL sock pointer is passed into l2cap_sock_alloc() when it is called from l2cap_sock_new_connection_cb() and the error handling paths should also be aware of it. Seemingly a more elegant solution would be to swap bt_sock_alloc() and l2cap_chan_create() calls since they are not interdependent to that moment but then l2cap_chan_create() adds the soon to be deallocated and still dummy-initialized channel to the global list accessible by many L2CAP paths. The channel would be removed from the list in short period of time but be a bit more straight-forward here and just check for NULL instead of changing the order of function calls. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool.",
"evidence": "osv:CVE-2024-58009",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.4.291",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.235",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.179",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.129",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.78",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.14",
"evidence": "/affected/1/ranges"
},
{
"value": "6.13.3",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2024-58009",
"aliases": [
"CVE-2024-58009"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "f6ad641646b67f29c7578dcd6c25813c7dcbf51e"
},
{
"fixed": "a9a7672fc1a0fe18502493936ccb06413ab89ea6"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "daa13175a6dea312a76099066cb4cbd4fc959a84"
},
{
"fixed": "8e605f580a97530e5a3583beea458a3fa4cbefbd"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "a8677028dd5123e5e525b8195483994d87123de4"
},
{
"fixed": "cf601a24120c674cd7c907ea695f92617af6abd0"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "bb2f2342a6ddf7c04f9aefbbfe86104cd138e629"
},
{
"fixed": "297ce7f544aa675b0d136d788cad0710cdfb0785"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "8ad09ddc63ace3950ac43db6fbfe25b40f589dd6"
},
{
"fixed": "245d48c1ba3e7a1779c2f4cbc6f581ddc8a78e22"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "61686abc2f3c2c67822aa23ce6f160467ec83d35"
},
{
"fixed": "691218a50c3139f7f57ffa79fb89d932eda9571e"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "7c4f78cdb8e7501e9f92d291a7d956591bf73be9"
},
{
"fixed": "49c0d55d59662430f1829ae85b969619573d0fa1"
},
{
"fixed": "5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.4.287"
},
{
"fixed": "5.4.291"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.10.231"
},
{
"fixed": "5.10.235"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.15.174"
},
{
"fixed": "5.15.179"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.1.120"
},
{
"fixed": "6.1.129"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.6.66"
},
{
"fixed": "6.6.78"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.12.5"
},
{
"fixed": "6.12.14"
}
]
}
],
"versions": [
"v5.4.290",
"v5.4.289",
"v5.4.288",
"v5.4.287",
"v5.10.234",
"v5.10.233",
"v5.10.232",
"v5.10.231",
"v5.15.178",
"v5.15.177",
"v5.15.176",
"v5.15.175",
"v5.15.174",
"v6.1.128",
"v6.1.127",
"v6.1.126",
"v6.1.125",
"v6.1.124",
"v6.1.123",
"v6.1.122",
"v6.1.121",
"v6.1.120",
"v6.6.77",
"v6.6.76",
"v6.6.75",
"v6.6.74",
"v6.6.73",
"v6.6.72",
"v6.6.71",
"v6.6.70",
"v6.6.69",
"v6.6.68",
"v6.6.67",
"v6.6.66",
"v6.12.13",
"v6.12.12",
"v6.12.11",
"v6.12.10",
"v6.12.9",
"v6.12.8",
"v6.12.7",
"v6.12.6",
"v6.12.5"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58009.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.4.291"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.235"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.179"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.129"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.78"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.14"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.13.3"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58009.json"
}
}
],
"modified": "2026-10-28T02:30:30.183678541Z",
"provider": "osv",
"references": [
"https://cert-portal.siemens.com/productcert/html/ssa-265688.html",
"https://cert-portal.siemens.com/productcert/html/ssa-784472.html",
"https://git.kernel.org/stable/c/245d48c1ba3e7a1779c2f4cbc6f581ddc8a78e22",
"https://git.kernel.org/stable/c/297ce7f544aa675b0d136d788cad0710cdfb0785",
"https://git.kernel.org/stable/c/49c0d55d59662430f1829ae85b969619573d0fa1",
"https://git.kernel.org/stable/c/5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1",
"https://git.kernel.org/stable/c/691218a50c3139f7f57ffa79fb89d932eda9571e",
"https://git.kernel.org/stable/c/8e605f580a97530e5a3583beea458a3fa4cbefbd",
"https://git.kernel.org/stable/c/a9a7672fc1a0fe18502493936ccb06413ab89ea6",
"https://git.kernel.org/stable/c/cf601a24120c674cd7c907ea695f92617af6abd0",
"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58009.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-58009",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58009.json"
}
},
"related_cves": [
{
"value": "CVE-2024-58009",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 496981,
"published_at": "2025-02-27T02:12:04.637+00:00"
}