CVE-2024-27398

CVE-2024-27398 refers to a use-after-free vulnerability found within the Linux kernel's Bluetooth subsystem. The vulnerability arises from a race condition during the disconnection of a SCO (Synchronous Connection-Oriented) link. Specifically, a timeout worker is scheduled to monitor the disconnection process. However, the socket associated with the SCO connection might be deallocated before the timeout worker completes its task. This leads to a situation where the worker attempts to access the already freed memory, resulting in a use-after-free error. This vulnerability can be triggered when a SCO connection is established and subsequently released. A cleanup thread deallocates the socket, while a separate worker thread, responsible for managing timeouts, might attempt to access the same memory region. This race condition allows for a use-after-free scenario, potentially leading to system instability or crashes. The issue was addressed by correcting the handling of SCO socket timeouts to prevent the worker thread from accessing deallocated memory.