CVE-2024-56591

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

The vulnerable teardown path lives in the Bluetooth HCI connection layer and is driven by connection setup/disconnect events from a peer device, so the attacker must be within Bluetooth radio range of the target. Per kernel scoring convention Bluetooth reachability is Adjacent.

AC:LAttack complexity, low

Although this is a race, the attacker controls both sides of it — repeatedly initiating and abruptly dropping L2CAP/LE connections drives `hci_conn_del()` on the HCI event path while concurrent channel teardown calls `hci_conn_drop()` and re-arms `disc_work`. The attempt can be retried indefinitely with no condition outside the attacker's influence.

PR:NPrivileges required, none

No privileges on the target are required: L2CAP/LE connection establishment and teardown occur before pairing or authentication, and no capability check exists anywhere on the path from packet/event handling to `hci_conn_del()`.

UI:NUser interaction, none

The entire sequence is driven by attacker-initiated link establishment and disconnection handled automatically by the kernel's HCI event processing. No action by a local user or victim is needed.

S:UScope, unchanged

The use-after-free corrupts kernel heap memory within the same kernel security authority, with no crossing of a VM, IOMMU, or sandbox boundary.

C:HConfidentiality impact, high

The re-armed delayed work leaves an armed timer and workqueue linkage inside a freed `hci_conn` slab object, and `hci_conn_timeout()`/`hci_conn_idle()` subsequently read attacker-groomed reallocated memory. This use-after-free gives an arbitrary kernel read primitive and can leak arbitrary kernel memory.

I:HIntegrity impact, high

`queue_delayed_work()`/`cancel_delayed_work()` write into the freed object, and the pending timer's `->function` and the work's `->func` are later dereferenced out of it, so heap spraying yields a controlled write and an indirect call — sufficient for control-flow hijack and kernel privilege escalation.

A:HAvailability impact, high

Even unexploited, the use-after-free dereferences freed slab memory from timer softirq and workqueue context, producing KASAN splats, oopses, or a kernel panic, which syzbot reproduced reliably.