VYPR
← All advisories
High severity7.1NVD Advisory· Published May 20, 2024· Updated May 12, 2026

CVE-2024-35966

CVE-2024-35966

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Fix not validating setsockopt user input

syzbot reported rfcomm_sock_setsockopt_old() is copying data without checking user input length.

BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt_old net/bluetooth/rfcomm/sock.c:632 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt+0x893/0xa70 net/bluetooth/rfcomm/sock.c:673 Read of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A slab-out-of-bounds write in the Linux kernel's Bluetooth RFCOMM setsockopt handler due to missing user input length validation.

Vulnerability

Details

CVE-2024-35966 is a slab-out-of-bounds write vulnerability in the Linux kernel's Bluetooth RFCOMM subsystem. The rfcomm_sock_setsockopt_old() function copies data from user space without first validating the length of the input, leading to a KASAN slab-out-of-bounds read. The bug resides in net/bluetooth/rfcomm/sock.c at line 632 and is triggered by a copy_from_sockptr call on an unvalidated user-supplied length.

Exploitation

An unprivileged local attacker who can open a Bluetooth RFCOMM socket can exploit this flaw by passing a crafted, oversized buffer via setsockopt. No special privileges or physical access to Bluetooth hardware are required—the syscall interface is accessible from user space. A successful trigger causes the kernel to read beyond the allocated slab, corrupting slab metadata or adjacent objects.

Impact

The out-of-bounds read can lead to system memory corruption, causing a denial of service (kernel panic) or potentially enabling information disclosure. While the official advisory [1] lists this CVE among many affecting Siemens SIMATIC S7-1500 TM MFP GNU/Linux subsystem, the core flaw is in the upstream Linux kernel and affects any system using the Bluetooth RFCOMM protocol.

Mitigation

Patches are available in the stable kernel trees [2][3][4]. The fix adds a length check to rfcomm_sock_setsockopt_old() before copying from user space. Users are advised to apply the latest kernel updates or disable Bluetooth if not needed.

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

119

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.