High · published May 15, 2021
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | < 4.4.269 | 4.4.269 |
| linux/linux_kernel | ≥ 4.5, < 4.9.269 | 4.9.269 |
| linux/linux_kernel | ≥ 4.10, < 4.14.233 | 4.14.233 |
| linux/linux_kernel | ≥ 4.15, < 4.19.191 | 4.19.191 |
| linux/linux_kernel | ≥ 4.20, < 5.4.119 | 5.4.119 |
| linux/linux_kernel | ≥ 5.5, < 5.10.37 | 5.10.37 |
| linux/linux_kernel | ≥ 5.11, < 5.11.21 | 5.11.21 |
| linux/linux_kernel | ≥ 5.12, < 5.12.4 | 5.12.4 |
| fedoraproject/fedora | all versions | — |
| debian/debian_linux | all versions | — |