Vulnerability CVE-2024-35966

Vulnerability CVE-2024-35966

Published: 2024-05-20

Description:

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Fix not validating setsockopt user input

syzbot reported rfcomm_sock_setsockopt_old() is copying data without
checking user input length.

BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset
include/linux/sockptr.h:49 [inline]
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr
include/linux/sockptr.h:55 [inline]
BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt_old
net/bluetooth/rfcomm/sock.c:632 [inline]
BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt+0x893/0xa70
net/bluetooth/rfcomm/sock.c:673
Read of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064

References:

https://git.kernel.org/stable/c/c3f787a3eafe519c93df9abbb0ca5145861c8d0f

https://git.kernel.org/stable/c/a97de7bff13b1cc825c1b1344eaed8d6c2d3e695

Copyright 2026, cxsecurity.com