🛡️ CVE-2024-46680 — kernel

🟠 CVSS 7.8 — High ✅ No Known Exploit NVD
7.8
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Bluetooth: btnxpuart: Fix random crash seen while removing driver

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btnxpuart: Fix random crash seen while removing driver

This fixes the random kernel crash seen while removing the driver, when

running the load/unload test over multiple iterations.

1) modprobe btnxpuart

2) hciconfig hci0 reset

3) hciconfig (check hci0 interface up with valid BD address)

4) modprobe -r btnxpuart

Repeat steps 1 to 4

The ps_wakeup() call in btnxpuart_close() schedules the psdata->work(),

which gets scheduled after module is removed, causing a kernel crash.

This hidden issue got highlighted after enabling Power Save by default

in 4183a7be7700 (Bluetooth: btnxpuart: Enable Power Save feature on

startup)

The new ps_cleanup() deasserts UART break immediately while closing

serdev device, cancels any scheduled ps_work and destroys the ps_lock

mutex.

[ 85.884604] Unable to handle kernel paging request at virtual address ffffd4a61638f258

[ 85.884624] Mem abort info:

[ 85.884625] ESR = 0x0000000086000007

[ 85.884628] EC = 0x21: IABT (current EL), IL = 32 bits

[ 85.884633] SET = 0, FnV = 0

[ 85.884636] EA = 0, S1PTW = 0

[ 85.884638] FSC = 0x07: level 3 translation fault

[ 85.884642] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041dd0000

[ 85.884646] [ffffd4a61638f258] pgd=1000000095fff003, p4d=1000000095fff003, pud=100000004823d003, pmd=100000004823e003, pte=0000000000000000

[ 85.884662] Internal error: Oops: 0000000086000007 [#1] PREEMPT SMP

[ 85.890932] Modules linked in: algif_hash algif_skcipher af_alg overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce polyval_generic snd_soc_imx_spdif snd_soc_imx_card snd_soc_ak5558 snd_soc_ak4458 caam secvio error snd_soc_fsl_spdif snd_soc_fsl_micfil snd_soc_fsl_sai snd_soc_fsl_utils gpio_ir_recv rc_core fuse [last unloaded: btnxpuart(O)]

[ 85.927297] CPU: 1 PID: 67 Comm: kworker/1:3 Tainted: G O 6.1.36+g937b1be4345a #1

[ 85.936176] Hardware name: FSL i.MX8MM EVK board (DT)

[ 85.936182] Workqueue: events 0xffffd4a61638f380

[ 85.936198] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)

[ 85.952817] pc : 0xffffd4a61638f258

[ 85.952823] lr : 0xffffd4a61638f258

[ 85.952827] sp : ffff8000084fbd70

[ 85.952829] x29: ffff8000084fbd70 x28: 0000000000000000 x27: 0000000000000000

[ 85.963112] x26: ffffd4a69133f000 x25: ffff4bf1c8540990 x24: ffff4bf215b87305

[ 85.963119] x23: ffff4bf215b87300 x22: ffff4bf1c85409d0 x21: ffff4bf1c8540970

[ 85.977382] x20: 0000000000000000 x19: ffff4bf1c8540880 x18: 0000000000000000

[ 85.977391] x17: 0000000000000000 x16: 0000000000000133 x15: 0000ffffe2217090

[ 85.977399] x14: 0000000000000001 x13: 0000000000000133 x12: 0000000000000139

[ 85.977407] x11: 0000000000000001 x10: 0000000000000a60 x9 : ffff8000084fbc50

[ 85.977417] x8 : ffff4bf215b7d000 x7 : ffff4bf215b83b40 x6 : 00000000000003e8

[ 85.977424] x5 : 00000000410fd030 x4 : 0000000000000000 x3 : 0000000000000000

[ 85.977432] x2 : 0000000000000000 x1 : ffff4bf1c4265880 x0 : 0000000000000000

[ 85.977443] Call trace:

[ 85.977446] 0xffffd4a61638f258

[ 85.977451] 0xffffd4a61638f3e8

[ 85.977455] process_one_work+0x1d4/0x330

[ 85.977464] worker_thread+0x6c/0x430

[ 85.977471] kthread+0x108/0x10c

[ 85.977476] ret_from_fork+0x10/0x20

[ 85.977488] Code: bad PC value

[ 85.977491] ---[ end trace 0000000000000000 ]---

Preset since v6.9.11

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity high, availability high.

Affected software

CVE-2024-46680 is recorded against 2 packages.

  • kernel (from 6.7.0 up to 6.10.8)
  • linux-kernel

Timeline and source

Published on 13 September 2024 and last revised on 6 August 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from NVD.

References

git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
github.com (Advisory)
nvd.nist.gov (Advisory)
git.kernel.org (Package)

CVE-2024-46680 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Severity High
CVSS Score 7.8
CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE N/A
Public Exploit ✅ No
Source NVD
Published 2024-09-13
Updated 2026-08-12
Modified 2026-08-06

Affected Packages

Software From version Fixed in
kernel 6.7.0 6.10.8
linux-kernel — —

Similar Threats

Site Security Check

Is kernel part of your stack?

CVE-2024-46680 is rated CVSS 7.8 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.