CVE-2024-35967

HighCVSS 7.1

Published: 20/05/2024(UTC)Updated: 04/08/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

A vulnerability has been identified in the Linux kernel's Bluetooth module, which involves a lack of validation of user input length in the sco_sock_setsockopt() function.

Risk Assessment

The lack of proper validation may lead to 'out-of-bounds' errors, creating a risk of potential buffer overflow and allowing attackers to execute malicious code.

Recommendation

It is recommended to update the Linux kernel to the latest version where this vulnerability has been fixed to minimize the risk associated with attacks exploiting this flaw.

Other vulnerabilities in Linux kernel Bluetooth module

CVE-2026-46123High
A vulnerability has been identified in the Linux kernel's Bluetooth module that allows improper processing of buffer length, potentially leading to exposure of uninitialized kernel memory. The issue occurs in the virtbt_rx_work() function, where the buffer length is not properly validated.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix not validating setsockopt user input syzbot reported sco_sock_setsockopt() is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90 net/bluetooth/sco.c:893 Read of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578