CVE-2024-21803: Linux Kernel Use-After-Free Vulnerability

CVE-2024-21803 Overview

CVE-2024-21803 is a use-after-free vulnerability [CWE-416] in the Linux kernel Bluetooth subsystem. The flaw resides in the af_bluetooth.c component of the kernel networking stack and affects Linux, x86, and ARM builds that include Bluetooth modules. A local authenticated attacker can trigger the freed memory reference to execute code in kernel context. The vulnerability affects Linux kernel versions from v2.6.12-rc2 through v6.8-rc1, covering nearly two decades of kernel releases. Exploitation impacts confidentiality, integrity, and availability at the host level.

Critical Impact
Successful exploitation allows local code execution in the kernel, resulting in full compromise of the affected Linux system.

Affected Products

Linux kernel v2.6.12-rc2 through v6.8-rc1
x86 and ARM Linux distributions shipping Bluetooth kernel modules
Downstream distributions using the af_bluetooth socket family (including OpenAnolis Cloud Kernel 5.10)

Discovery Timeline

2024-01-30 - CVE-2024-21803 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-21803

Vulnerability Analysis

The vulnerability is a use-after-free condition in the Linux kernel Bluetooth address family implementation. The affected source file is net/bluetooth/af_bluetooth.c, which implements socket-level operations for Bluetooth protocol families such as L2CAP, RFCOMM, HCI, and SCO. When kernel code continues to reference a Bluetooth socket structure after its backing memory has been released, an attacker can influence the contents of the reallocated memory to hijack control flow.

Exploitation requires local access and low privileges. No user interaction is needed, and the attack complexity is low. Because the flaw resides in kernel-mode code, successful exploitation grants the attacker execution in ring 0, allowing arbitrary code execution, privilege escalation to root, and disabling of security controls.

Root Cause

The defect stems from improper lifetime management of Bluetooth socket objects in af_bluetooth.c. Reference counting or locking around socket teardown and concurrent operations fails to prevent code paths from dereferencing an object after kfree. The very long affected range (v2.6.12-rc2 to v6.8-rc1) indicates the flaw was introduced early in the Bluetooth subsystem's history and remained latent until identified.

Attack Vector

A local attacker who can open Bluetooth sockets (typically any user process with access to the AF_BLUETOOTH family) races or manipulates socket operations to free a kernel object while another code path still holds a pointer to it. The attacker then reclaims the freed slab allocation with controlled data using standard kernel heap-spraying primitives and triggers the dangling reference, redirecting execution into attacker-controlled memory. Technical specifics are tracked in the OpenAnolis Bug Report #8081.

Detection Methods for CVE-2024-21803

Indicators of Compromise

Unexpected kernel oops, panic, or KASAN: use-after-free reports referencing net/bluetooth/af_bluetooth.c or related symbols
Unprivileged processes that suddenly acquire root capabilities after interacting with AF_BLUETOOTH sockets
Unusual loading or interaction patterns with the bluetooth, bnep, l2cap, or rfcomm kernel modules on systems that do not use Bluetooth

Detection Strategies

Enable CONFIG_KASAN in test environments to surface use-after-free conditions during Bluetooth socket fuzzing
Audit kernel version inventory against the affected range v2.6.12-rc2 through v6.8-rc1
Correlate auditd events for socket(AF_BLUETOOTH, ...) system calls by non-Bluetooth workloads with subsequent privilege changes

Monitoring Recommendations

Monitor /var/log/kern.log and dmesg for slab corruption, general protection faults, or KASAN reports tied to Bluetooth symbols
Track setuid, capset, and credential-changing syscalls executed by processes that also opened AF_BLUETOOTH sockets
Alert on kernel module load events for Bluetooth stack components on servers where Bluetooth is not required

How to Mitigate CVE-2024-21803

Immediate Actions Required

Upgrade the Linux kernel to v6.8-rc1 or later, or apply the distribution-provided backport that resolves the af_bluetooth.c use-after-free
On systems that do not need Bluetooth, blacklist the bluetooth kernel module family to remove the attack surface entirely
Restrict which local users can create AF_BLUETOOTH sockets using seccomp profiles, SELinux, or AppArmor policies

Patch Information

The issue is fixed in Linux kernel v6.8-rc1 and later releases. Downstream vendors including the OpenAnolis project have tracked and backported the fix; refer to OpenAnolis Bug Report #8081 for the upstream reference and distribution-specific advisories.

Workarounds

Blacklist Bluetooth kernel modules on servers and appliances that do not require them
Apply seccomp filters to block the socket() syscall with AF_BLUETOOTH for untrusted local users
Enforce Mandatory Access Control (MAC) policies that deny AF_BLUETOOTH socket creation outside of authorized Bluetooth service accounts

bash

# Blacklist Bluetooth kernel modules where Bluetooth is not required
cat <<'EOF' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
blacklist bluetooth
blacklist btusb
blacklist bnep
blacklist rfcomm
install bluetooth /bin/true
EOF

# Unload currently loaded modules and update initramfs
sudo rmmod rfcomm bnep btusb bluetooth 2>/dev/null || true
sudo update-initramfs -u