{"timestamp":"2025-10-01T20:23:28.558687Z","id":"CVE-2024-50077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ccf74f2390d60a2f9a75ef496d2564abb478f46a","lessThan":"fa4b832c5a6ec35023a1b997cf658c436619c752","versionType":"git","status":"affected"},{"version":"ccf74f2390d60a2f9a75ef496d2564abb478f46a","lessThan":"8fb8e912afb4c47dec12ea9a5853e7a8db95816f","versionType":"git","status":"affected"},{"version":"ccf74f2390d60a2f9a75ef496d2564abb478f46a","lessThan":"adf1b179c2ff8073c24bf87e5a605fcc5a09798b","versionType":"git","status":"affected"},{"version":"ccf74f2390d60a2f9a75ef496d2564abb478f46a","lessThan":"a9b7b535ba192c6b77e6c15a4c82d853163eab8c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"6.1.114","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.58","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.11.5","lessThanOrEqual":"6.11.*","versionType":"semver","status":"unaffected"},{"version":"6.12","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NIST NVD-CWE-noinfo

OR
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.0 up to (excluding) 6.1.114
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.58
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.11.5
     *cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
     *cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
     *cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*

https://git.kernel.org/stable/c/8fb8e912afb4c47dec12ea9a5853e7a8db95816f No Types Assigned

https://git.kernel.org/stable/c/8fb8e912afb4c47dec12ea9a5853e7a8db95816f Patch

https://git.kernel.org/stable/c/a9b7b535ba192c6b77e6c15a4c82d853163eab8c No Types Assigned

https://git.kernel.org/stable/c/a9b7b535ba192c6b77e6c15a4c82d853163eab8c Patch

https://git.kernel.org/stable/c/adf1b179c2ff8073c24bf87e5a605fcc5a09798b No Types Assigned

https://git.kernel.org/stable/c/adf1b179c2ff8073c24bf87e5a605fcc5a09798b Patch

https://git.kernel.org/stable/c/fa4b832c5a6ec35023a1b997cf658c436619c752 No Types Assigned

https://git.kernel.org/stable/c/fa4b832c5a6ec35023a1b997cf658c436619c752 Patch

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Fix multiple init when debugfs is disabled

If bt_debugfs is not created successfully, which happens if either
CONFIG_DEBUG_FS or CONFIG_DEBUG_FS_ALLOW_ALL is unset, then iso_init()
returns early and does not set iso_inited to true. This means that a
subsequent call to iso_init() will result in duplicate calls to
proto_register(), bt_sock_register(), etc.

With CONFIG_LIST_HARDENED and CONFIG_BUG_ON_DATA_CORRUPTION enabled, the
duplicate call to proto_register() triggers this BUG():

  list_add double add: new=ffffffffc0b280d0, prev=ffffffffbab56250,
    next=ffffffffc0b280d0.
  ------------[ cut here ]------------
  kernel BUG at lib/list_debug.c:35!
  Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI
  CPU: 2 PID: 887 Comm: bluetoothd Not tainted 6.10.11-1-ao-desktop #1
  RIP: 0010:__list_add_valid_or_report+0x9a/0xa0
  ...
    __list_add_valid_or_report+0x9a/0xa0
    proto_register+0x2b5/0x340
    iso_init+0x23/0x150 [bluetooth]
    set_iso_socket_func+0x68/0x1b0 [bluetooth]
    kmem_cache_free+0x308/0x330
    hci_sock_sendmsg+0x990/0x9e0 [bluetooth]
    __sock_sendmsg+0x7b/0x80
    sock_write_iter+0x9a/0x110
    do_iter_readv_writev+0x11d/0x220
    vfs_writev+0x180/0x3e0
    do_writev+0xca/0x100
  ...

This change removes the early return. The check for iso_debugfs being
NULL was unnecessary, it is always NULL when iso_inited is false.

kernel.org https://git.kernel.org/stable/c/8fb8e912afb4c47dec12ea9a5853e7a8db95816f [No types assigned]

kernel.org https://git.kernel.org/stable/c/a9b7b535ba192c6b77e6c15a4c82d853163eab8c [No types assigned]

kernel.org https://git.kernel.org/stable/c/adf1b179c2ff8073c24bf87e5a605fcc5a09798b [No types assigned]

kernel.org https://git.kernel.org/stable/c/fa4b832c5a6ec35023a1b997cf658c436619c752 [No types assigned]