In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout

When the sco connection is established and then, the sco socket
is releasing, timeout_work will be scheduled to judge whether
the sco disconnection is timeout. The sock will be deallocated
later, but it is dereferenced again in sco_sock_timeout. As a
result, the use-after-free bugs will happen. The root cause is
shown below:

Cleanup Thread | Worker Thread
sco_sock_release |
sco_sock_close |
__sco_sock_close |
sco_sock_set_timer |
schedule_delayed_work |
sco_sock_kill | (wait a time)
sock_put(sk) //FREE | sco_sock_timeout
| sock_hold(sk) //USE

The KASAN report triggered by POC is shown below:

[ 95.890016] ==================================================================
[ 95.890496] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x5e/0x1c0
[ 95.890755] Write of size 4 at addr ffff88800c388080 by task kworker/0:0/7
...
[ 95.890755] Workqueue: events sco_sock_timeout
[ 95.890755] Call Trace:
[ 95.890755] <TASK>
[ 95.890755] dump_stack_lvl+0x45/0x110
[ 95.890755] print_address_description+0x78/0x390
[ 95.890755] print_report+0x11b/0x250
[ 95.890755] ? __virt_addr_valid+0xbe/0xf0
[ 95.890755] ? sco_sock_timeout+0x5e/0x1c0
[ 95.890755] kasan_report+0x139/0x170
[ 95.890755] ? update_load_avg+0xe5/0x9f0
[ 95.890755] ? sco_sock_timeout+0x5e/0x1c0
[ 95.890755] kasan_check_range+0x2c3/0x2e0
[ 95.890755] sco_sock_timeout+0x5e/0x1c0
[ 95.890755] process_one_work+0x561/0xc50
[ 95.890755] worker_thread+0xab2/0x13c0
[ 95.890755] ? pr_cont_work+0x490/0x490
[ 95.890755] kthread+0x279/0x300
[ 95.890755] ? pr_cont_work+0x490/0x490
[ 95.890755] ? kthread_blkcg+0xa0/0xa0
[ 95.890755] ret_from_fork+0x34/0x60
[ 95.890755] ? kthread_blkcg+0xa0/0xa0
[ 95.890755] ret_from_fork_asm+0x11/0x20
[ 95.890755] </TASK>
[ 95.890755]
[ 95.890755] Allocated by task 506:
[ 95.890755] kasan_save_track+0x3f/0x70
[ 95.890755] __kasan_kmalloc+0x86/0x90
[ 95.890755] __kmalloc+0x17f/0x360
[ 95.890755] sk_prot_alloc+0xe1/0x1a0
[ 95.890755] sk_alloc+0x31/0x4e0
[ 95.890755] bt_sock_alloc+0x2b/0x2a0
[ 95.890755] sco_sock_create+0xad/0x320
[ 95.890755] bt_sock_create+0x145/0x320
[ 95.890755] __sock_create+0x2e1/0x650
[ 95.890755] __sys_socket+0xd0/0x280
[ 95.890755] __x64_sys_socket+0x75/0x80
[ 95.890755] do_syscall_64+0xc4/0x1b0
[ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f
[ 95.890755]
[ 95.890755] Freed by task 506:
[ 95.890755] kasan_save_track+0x3f/0x70
[ 95.890755] kasan_save_free_info+0x40/0x50
[ 95.890755] poison_slab_object+0x118/0x180
[ 95.890755] __kasan_slab_free+0x12/0x30
[ 95.890755] kfree+0xb2/0x240
[ 95.890755] __sk_destruct+0x317/0x410
[ 95.890755] sco_sock_release+0x232/0x280
[ 95.890755] sock_close+0xb2/0x210
[ 95.890755] __fput+0x37f/0x770
[ 95.890755] task_work_run+0x1ae/0x210
[ 95.890755] get_signal+0xe17/0xf70
[ 95.890755] arch_do_signal_or_restart+0x3f/0x520
[ 95.890755] syscall_exit_to_user_mode+0x55/0x120
[ 95.890755] do_syscall_64+0xd1/0x1b0
[ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f
[ 95.890755]
[ 95.890755] The buggy address belongs to the object at ffff88800c388000
[ 95.890755] which belongs to the cache kmalloc-1k of size 1024
[ 95.890755] The buggy address is located 128 bytes inside of
[ 95.890755] freed 1024-byte region [ffff88800c388000, ffff88800c388400)
[ 95.890755]
[ 95.890755] The buggy address belongs to the physical page:
[ 95.890755] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800c38a800 pfn:0xc388
[ 95.890755] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 95.890755] ano
---truncated---

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0071.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
48669c81a65628ef234cbdd91b9395952c7c27fe affected
< 1b33d55fb7355e27f8c82cd4ecd560f162469249
37d7ae2b0578f2373674a755402ee722e96edc08 affected
< 3212afd00e3cda790fd0583cb3eaef8f9575a014
a1073aad497d0d071a71f61b721966a176d50c08 affected
< 33a6e92161a78c1073d90e27abe28d746feb0a53
ba316be1b6a00db7126ed9a39f9bee434a508043 affected
< 6a18eeb1b3bbc67c20d9609c31dca6a69b4bcde5
ba316be1b6a00db7126ed9a39f9bee434a508043 affected
< bfab2c1f7940a232cd519e82fff137e308abfd93
ba316be1b6a00db7126ed9a39f9bee434a508043 affected
< 012363cb1bec5f33a7b94629ab2c1086f30280f2
ba316be1b6a00db7126ed9a39f9bee434a508043 affected
< 50c2037fc28df870ef29d9728c770c8955d32178
ba316be1b6a00db7126ed9a39f9bee434a508043 affected
< 483bc08181827fc475643272ffb69c533007e546
fea63ccd928c01573306983346588b26cffb5572 affected
—
ec1f74319bb35c1c90c25014ec0f6ea6c3ca2134 affected
—
b657bba82ff6a007d84fd076bd73b11131726a2b affected
—
Linux Linux affected
Version Status Constraints
5.15 affected
—
0 unaffected
< 5.15
4.19.314 unaffected
≤ 4.19.*
5.4.276 unaffected
≤ 5.4.*
5.10.217 unaffected
≤ 5.10.*
5.15.159 unaffected
≤ 5.15.*
6.1.91 unaffected
≤ 6.1.*
6.6.31 unaffected
≤ 6.6.*
6.8.10 unaffected
≤ 6.8.*
6.9 unaffected
≤ *

Configuration 1 [-]

OR cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*

Configuration 3 [-]

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 9
kernel-0:5.14.0-570.12.1.el9_6 cpe:/a:redhat:enterprise_linux:9 RHSA-2025:6966 2025-05-13T00:00:00Z
kernel-0:5.14.0-570.12.1.el9_6 cpe:/o:redhat:enterprise_linux:9 RHSA-2025:6966 2025-05-13T00:00:00Z

No data.

Subscriptions

Vendors Products
Debian Subscribe
Debian Linux Subscribe
Fedoraproject Subscribe
Fedora Subscribe
Linux Subscribe
Linux Kernel Subscribe
Redhat Subscribe
Enterprise Linux Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-3840-1 linux security update
Debian DLA Debian DLA DLA-3843-1 linux-5.10 security update
Debian DSA Debian DSA DSA-5703-1 linux security update
Ubuntu USN Ubuntu USN USN-6949-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6949-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6950-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6950-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6950-3 Linux kernel (Oracle) vulnerabilities
Ubuntu USN Ubuntu USN USN-6950-4 Linux kernel (HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-6951-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6951-2 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-6951-3 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-6951-4 Linux kernel (BlueField) vulnerabilities
Ubuntu USN Ubuntu USN USN-6952-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6953-1 Linux kernel (Oracle) vulnerabilities
Ubuntu USN Ubuntu USN USN-6955-1 Linux kernel (OEM) vulnerabilities
Ubuntu USN Ubuntu USN USN-6956-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-6957-1 Linux kernel (Oracle) vulnerabilities
Ubuntu USN Ubuntu USN USN-6979-1 Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN Ubuntu USN USN-7019-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7028-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7028-2 Linux kernel (Azure) vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://www.openwall.com/lists/oss-security/2024/11/29/1 cve-icon
http://www.openwall.com/lists/oss-security/2024/11/30/1 cve-icon
http://www.openwall.com/lists/oss-security/2024/11/30/2 cve-icon
https://git.kernel.org/stable/c/012363cb1bec5f33a7b94629ab2c1086f30280f2 cve-icon cve-icon
https://git.kernel.org/stable/c/1b33d55fb7355e27f8c82cd4ecd560f162469249 cve-icon cve-icon
https://git.kernel.org/stable/c/3212afd00e3cda790fd0583cb3eaef8f9575a014 cve-icon cve-icon
https://git.kernel.org/stable/c/33a6e92161a78c1073d90e27abe28d746feb0a53 cve-icon cve-icon
https://git.kernel.org/stable/c/483bc08181827fc475643272ffb69c533007e546 cve-icon cve-icon
https://git.kernel.org/stable/c/50c2037fc28df870ef29d9728c770c8955d32178 cve-icon cve-icon
https://git.kernel.org/stable/c/6a18eeb1b3bbc67c20d9609c31dca6a69b4bcde5 cve-icon cve-icon
https://git.kernel.org/stable/c/bfab2c1f7940a232cd519e82fff137e308abfd93 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html cve-icon
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DW2MIOIMOFUSNLHLRYX23AFR36BMKD65/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTB4HWU2PTVW5NEYHHLOCXDKG3PYA534/ cve-icon
https://lore.kernel.org/linux-cve-announce/2024051355-CVE-2024-27398-08ef@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-27398 cve-icon
https://security.netapp.com/advisory/ntap-20240912-0012/ cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-27398 cve-icon
History

Thu, 22 Jan 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Debian
Debian debian Linux
Fedoraproject
Fedoraproject fedora
Linux
Linux linux Kernel
Weaknesses CWE-416
CPEs cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*
Vendors & Products Debian
Debian debian Linux
Fedoraproject
Fedoraproject fedora
Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 14 May 2025 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux

Sat, 30 Nov 2024 08:45:00 +0000

Type Values Removed Values Added
References

Sat, 30 Nov 2024 05:30:00 +0000

Type Values Removed Values Added
References

Fri, 29 Nov 2024 08:30:00 +0000

Type Values Removed Values Added
References

Fri, 29 Nov 2024 08:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 13 Sep 2024 08:30:00 +0000

Type Values Removed Values Added
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-05-04T12:55:31.938Z

Reserved: 2024-02-25T13:47:42.681Z

Link: CVE-2024-27398

cve-icon Vulnrichment

Updated: 2024-11-30T08:03:15.930Z

cve-icon NVD

Status : Analyzed

Published: 2024-05-14T15:12:28.623

Modified: 2026-01-22T20:37:07.763

Link: CVE-2024-27398

cve-icon Redhat

Severity : Low

Publid Date: 2024-05-13T00:00:00Z

Links: CVE-2024-27398 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses