Skip to content
OpenAdvisories
Unscored CVE-2024-44962 EUVD-2024-41165GHSA-qqj2-pmc2-p5vr

Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading

Published Sep 4, 2024 · Updated May 11, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: kernel Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-6.8 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-lowlatency Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx Platform: Linux Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading

When unload the btnxpuart driver, its associated timer will be deleted.
If the timer happens to be modified at this moment, it leads to the
kernel call this timer even after the driver unloaded, resulting in
kernel panic.
Use timer_shutdown_sync() instead of del_timer_sync() to prevent rearming.

panic log:
Internal error: Oops: 0000000086000007 [#1] PREEMPT SMP
Modules linked in: algif_hash algif_skcipher af_alg moal(O) mlan(O) crct10dif_ce polyval_ce polyval_generic snd_soc_imx_card snd_soc_fsl_asoc_card snd_soc_imx_audmux mxc_jpeg_encdec v4l2_jpeg snd_soc_wm8962 snd_soc_fsl_micfil snd_soc_fsl_sai flexcan snd_soc_fsl_utils ap130x rpmsg_ctrl imx_pcm_dma can_dev rpmsg_char pwm_fan fuse [last unloaded: btnxpuart]
CPU: 5 PID: 723 Comm: memtester Tainted: G O 6.6.23-lts-next-06207-g4aef2658ac28 #1
Hardware name: NXP i.MX95 19X19 board (DT)
pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : 0xffff80007a2cf464
lr : call_timer_fn.isra.0+0x24/0x80
...
Call trace:
0xffff80007a2cf464
__run_timers+0x234/0x280
run_timer_softirq+0x20/0x40
__do_softirq+0x100/0x26c
____do_softirq+0x10/0x1c
call_on_irq_stack+0x24/0x4c
do_softirq_own_stack+0x1c/0x2c
irq_exit_rcu+0xc0/0xdc
el0_interrupt+0x54/0xd8
__el0_irq_handler_common+0x18/0x24
el0t_64_irq_handler+0x10/0x1c
el0t_64_irq+0x190/0x194
Code: ???????? ???????? ???????? ???????? (????????)
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Oops: Fatal exception in interrupt
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x0,c0000000,40028143,1000721b
Memory Limit: none
---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---

Affected products

VendorProductAffectedFixed
Linux Linux 6.4 6.6.46

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.10.6-1 —
Debian 13 linux 6.10.6-1 —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux 6.8.0-50.51 USN-7154-1
Ubuntu 24.04 LTS linux-aws 6.8.0-1020.22 USN-7154-1
Ubuntu 24.04 LTS linux-azure 6.8.0-1020.23 USN-7196-1
Ubuntu 24.04 LTS linux-gcp +1 6.8.0-1019.21 USN-7155-1, USN-7154-1
Ubuntu 24.04 LTS linux-gke 6.8.0-1015.19 USN-7154-1
Ubuntu 24.04 LTS linux-gkeop 6.8.0-1002.4 USN-7156-1
Ubuntu 24.04 LTS linux-ibm 6.8.0-1017.17 USN-7154-1
Ubuntu 24.04 LTS linux-nvidia-lowlatency 6.8.0-1019.21.1 USN-7155-1
Ubuntu 24.04 LTS linux-oem-6.8 6.8.0-1018.18 USN-7154-1
Ubuntu 24.04 LTS linux-oracle +1 6.8.0-1017.18 USN-7154-1
Ubuntu 24.04 LTS linux-raspi 6.8.0-1016.18 USN-7154-1
Ubuntu 24.04 LTS linux-riscv +1 6.8.0-50.51.1 USN-7154-1
Ubuntu 22.04 LTS linux-aws-6.8 6.8.0-1020.22~22.04.1 USN-7154-1
Ubuntu 22.04 LTS linux-azure-6.8 6.8.0-1020.23~22.04.1 USN-7196-1
Ubuntu 22.04 LTS linux-gcp-6.8 +1 6.8.0-1019.21~22.04.1 USN-7155-1, USN-7154-1
Ubuntu 22.04 LTS linux-hwe-6.8 6.8.0-50.51~22.04.1 USN-7154-2
Ubuntu 22.04 LTS linux-ibm-6.8 6.8.0-1017.17~22.04.1 —
Ubuntu 22.04 LTS linux-oracle-6.8 6.8.0-1017.18~22.04.1 USN-7154-1
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 22.04 LTS linux-riscv-6.8 +1 6.8.0-50.51.1~22.04.1 USN-7154-1
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2015.16 —
Ubuntu Pro Realtime 24.04 LTS linux-realtime 6.8.1-1013.14 —
Ubuntu Pro Realtime 22.04 LTS linux-realtime-6.8 6.8.1-1013.14~22.04.1 —
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips 6.8.0-78.78+fips1 —
ReleasePackageFixed inAdvisory
SLES 15 SP6 kernel-64kb +4 6.4.0-150600.23.25.1 SUSE-SU-2024:3561-1
SLES 15 SP6 kernel-azure +2 6.4.0-150600.8.14.1 SUSE-SU-2024:3551-1
SLES 15 SP6 kernel-coco +3 6.4.0-15061.6.coco15sp6.1 SUSE-SU-2024:3553-1
SLES 15 SP6 kernel-default-base 6.4.0-150600.23.25.1.150600.12.10.2 SUSE-SU-2024:3561-1
SLES 15 SP6 kernel-docs +1 6.4.0-150600.23.25.2 SUSE-SU-2024:3561-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.0 kernel-default-base 6.4.0-17.1.1.51 SUSE-SU-2025:20073-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_3 +1 1-1.2 SUSE-SU-2025:20077-1, SUSE-SU-2025:20073-1
SLE Micro 6.0 kernel-rt +1 6.4.0-11.1 SUSE-SU-2025:20077-1
SLE Micro 6.0 kernel-source +2 6.4.0-20.1 SUSE-SU-2025:20073-1
SLE Live Patching 15 SP6 kernel-default 6.4.0-150600.23.25.1 SUSE-SU-2024:3561-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_4 1-150600.1.3.1 SUSE-SU-2024:3564-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_5 1-150600.13.3.1 SUSE-SU-2024:3561-1
SUSE Real Time Module 15 SP6 kernel-rt +3 6.4.0-150600.10.14.1 SUSE-SU-2024:3564-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 dtb-aarch64 +8 6.4.0-150600.23.25.1 SUSE-SU-2024:3561-1
openSUSE Leap 15.6 kernel-azure +2 6.4.0-150600.8.14.1 SUSE-SU-2024:3551-1
openSUSE Leap 15.6 kernel-default-base 6.4.0-150600.23.25.1.150600.12.10.2 SUSE-SU-2024:3561-1
openSUSE Leap 15.6 kernel-docs +1 6.4.0-150600.23.25.2 SUSE-SU-2024:3561-1
openSUSE Leap 15.6 kernel-rt +3 6.4.0-150600.10.14.1 SUSE-SU-2024:3564-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) kernel No fix yet —

Advisories 12

References