CVE-2024-46680

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btnxpuart: Fix random crash seen while removing driver

This fixes the random kernel crash seen while removing the driver, when

running the load/unload test over multiple iterations.

1) modprobe btnxpuart

2) hciconfig hci0 reset

3) hciconfig (check hci0 interface up with valid BD address)

4) modprobe -r btnxpuart

Repeat steps 1 to 4

The ps_wakeup() call in btnxpuart_close() schedules the psdata->work(),

which gets scheduled after module is removed, causing a kernel crash.

This hidden issue got highlighted after enabling Power Save by default

in 4183a7be7700 (Bluetooth: btnxpuart: Enable Power Save feature on

startup)

The new ps_cleanup() deasserts UART break immediately while closing

serdev device, cancels any scheduled ps_work and destroys the ps_lock

mutex.

[ 85.884604] Unable to handle kernel paging request at virtual address ffffd4a61638f258

[ 85.884624] Mem abort info:

[ 85.884625] ESR = 0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References