Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.19 % · percentile 8 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change rfcomm_sk_state_change attempts to use sock_lock so it must never be called with it locked but rfcomm_sock_ioctl always attempt to lock it causing the following trace: ====================================================== WARNING: possible circular locking dependency detected 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted ------------------------------------------------------ syz-executor386/5093 is trying to acquire lock: ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline] ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73 but task is already holding lock: ffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491
Weaknesses (CWE)
- CWE-667 — Improper Locking
References
- https://git.kernel.org/stable/c/b77b3fb12fd483cae7c28648903b1d8a6b275f01
- https://git.kernel.org/stable/c/869c6ee62ab8f01bf2419e45326642be5c9b670a
- https://git.kernel.org/stable/c/ef44274dae9b0a90d1a97ce8b242a3b8243a7745
- https://git.kernel.org/stable/c/496b2ab0fd10f205e08909a125485fdc98843dbe
- https://git.kernel.org/stable/c/ced98072d3511b232ae1d3347945f35f30c0e303
- https://git.kernel.org/stable/c/38b2d5a57d125e1c17661b8308c0240c4a43b534
- https://git.kernel.org/stable/c/4cb9807c9b53bf1e5560420d26f319f528b50268
- https://git.kernel.org/stable/c/08d1914293dae38350b8088980e59fbc699a72fe
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | LOW 3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-44983
- GCVE · GCVE-0-2024-50044
CERT-FR advisories
- CERTFR-2025-AVI-0677 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0366 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0349 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0276 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0185 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0184 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0168 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0152 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0069 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0024 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0022 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0002 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1108 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1102 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1101 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0999 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 2.6.27 < 5.10.227cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.168cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.113cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.57cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.11.4cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 3241ad820dbb172021e0268b5611031991431626 < b77b3fb12fd483cae7c28648903b1d8a6b275f01 ; affected 3241ad820dbb172021e0268b5611031991431626 < 869c6ee62ab8f01bf2419e45326642be5c9b670a ; affected 3241ad820dbb172021e0268b5611031991431626 < ef44274dae9b0a90d1a97ce8b242a3b8243a7745 ; affected 3241ad820dbb172021e0268b5611031991431626 < 496b2ab0fd10f205e08909a125485fdc98843dbe ; affected 3241ad820dbb172021e0268b5611031991431626 < ced98072d3511b232ae1d3347945f35f30c0e303 ; affected 3241ad820dbb172021e0268b5611031991431626 < 38b2d5a57d125e1c17661b8308c0240c4a43b534 |
| Linux · Linux | affected 2.6.27 ; unaffected 0 < 2.6.27 ; unaffected 4.19.323 ≤ 4.19.* ; unaffected 5.4.285 ≤ 5.4.* ; unaffected 5.10.227 ≤ 5.10.* ; unaffected 5.15.168 ≤ 5.15.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |