What is the CVSS score of CVE-2024-26890?

CVE-2024-26890 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Linux Kernel are affected by CVE-2024-26890?

CVE-2024-26890 is a Linux kernel vulnerability in Realtek Bluetooth UART drivers that could enable local privilege escalation or system crashes; no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2024-26890?

Within 24 hours: Survey your infrastructure to identify Linux systems with Realtek Bluetooth devices connected via UART/H5 protocol and determine which are accessible to local users; contact your Linux vendor or OEM to confirm patch availability and release dates. Within 7 days: Deploy the available kernel patches to all identified affected systems, beginning with those in high-risk environments with local user access. Within 30 days: Complete patch deployment across your organization and conduct verification through kernel version auditing to ensure remediation.

Linux Kernel CVE-2024-26890

HIGH

Out-of-bounds Read (CWE-125)

2024-04-17 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Buffer Overflow Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

AC:H reflects the specific hardware prerequisite (Realtek BT chip via H5 UART); PR:L required for local trigger; full C/I/A from kernel heap corruption.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 13:17 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 13:16 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 13:15 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

6.5 (MEDIUM) 7.8 (HIGH)

CVE Published

Apr 17, 2024 - 11:15 cve.org

MEDIUM 6.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btrtl: fix out of bounds memory access

The problem is detected by KASAN. btrtl driver uses private hci data to store 'struct btrealtek_data'. If btrtl driver is used with btusb, then memory for private hci data is allocated in btusb. But no private data is allocated after hci_dev, when btrtl is used with hci_h5.

This commit adds memory allocation for hci_h5 case.

============== BUG: KASAN: slab-out-of-bounds in btrtl_initialize+0x6cc/0x958 [btrtl] Write of size 8 at addr ffff00000f5a5748 by task kworker/u9:0/76

Hardware name: Pine64 PinePhone (1.2) (DT) Workqueue: hci0 hci_power_on [bluetooth] Call trace: dump_backtrace+0x9c/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5d8 kasan_report+0x90/0xd0 __asan_store8+0x9c/0xc0 [btrtl] h5_btrtl_setup+0xd0/0x2f8 [hci_uart] h5_setup+0x50/0x80 [hci_uart] hci_uart_setup+0xd4/0x260 [hci_uart] hci_dev_open_sync+0x1cc/0xf68 [bluetooth] hci_dev_do_open+0x34/0x90 [bluetooth] hci_power_on+0xc4/0x3c8 [bluetooth] process_one_work+0x328/0x6f0 worker_thread+0x410/0x778 kthread+0x168/0x178 ret_from_fork+0x10/0x20

Allocated by task 53: kasan_save_stack+0x3c/0x68 kasan_save_track+0x20/0x40 kasan_save_alloc_info+0x68/0x78 __kasan_kmalloc+0xd4/0xd8 __kmalloc+0x1b4/0x3b0 hci_alloc_dev_priv+0x28/0xa58 [bluetooth] hci_uart_register_device+0x118/0x4f8 [hci_uart] h5_serdev_probe+0xf4/0x178 [hci_uart] serdev_drv_probe+0x54/0xa0 really_probe+0x254/0x588 __driver_probe_device+0xc4/0x210 driver_probe_device+0x64/0x160 __driver_attach_async_helper+0x88/0x158 async_run_entry_fn+0xd0/0x388 process_one_work+0x328/0x6f0 worker_thread+0x410/0x778 kthread+0x168/0x178 ret_from_fork+0x10/0x20

Last potentially related work creation: kasan_save_stack+0x3c/0x68 __kasan_record_aux_stack+0xb0/0x150 kasan_record_aux_stack_noalloc+0x14/0x20 __queue_work+0x33c/0x960 queue_work_on+0x98/0xc0 hci_recv_frame+0xc8/0x1e8 [bluetooth] h5_complete_rx_pkt+0x2c8/0x800 [hci_uart] h5_rx_payload+0x98/0xb8 [hci_uart] h5_recv+0x158/0x3d8 [hci_uart] hci_uart_receive_buf+0xa0/0xe8 [hci_uart] ttyport_receive_buf+0xac/0x178 flush_to_ldisc+0x130/0x2c8 process_one_work+0x328/0x6f0 worker_thread+0x410/0x778 kthread+0x168/0x178 ret_from_fork+0x10/0x20

Second to last potentially related work creation: kasan_save_stack+0x3c/0x68 __kasan_record_aux_stack+0xb0/0x150 kasan_record_aux_stack_noalloc+0x14/0x20 __queue_work+0x788/0x960 queue_work_on+0x98/0xc0 __hci_cmd_sync_sk+0x23c/0x7a0 [bluetooth] __hci_cmd_sync+0x24/0x38 [bluetooth] btrtl_initialize+0x760/0x958 [btrtl] h5_btrtl_setup+0xd0/0x2f8 [hci_uart] h5_setup+0x50/0x80 [hci_uart] hci_uart_setup+0xd4/0x260 [hci_uart] hci_dev_open_sync+0x1cc/0xf68 [bluetooth] hci_dev_do_open+0x34/0x90 [bluetooth] hci_power_on+0xc4/0x3c8 [bluetooth] process_one_work+0x328/0x6f0 worker_thread+0x410/0x778 kthread+0x168/0x178 ret_from_fork+0x10/0x20 ==============

AnalysisAI

Slab-out-of-bounds memory write in the Linux kernel's Bluetooth btrtl driver corrupts kernel heap memory when a Realtek Bluetooth device is initialized over the H5 UART serial protocol (hci_h5). Unlike the btusb path - which correctly allocates private HCI data - the hci_h5 code path omitted the allocation of 'struct btrealtek_data', causing btrtl_initialize to write 8 bytes beyond the hci_dev allocation boundary. Exploitation requires local low-privileged access on a system equipped with a Realtek Bluetooth chip attached via UART/H5, with CVSS 7.8 (High). No public exploit code has been identified and EPSS is 0.76%, though successful kernel heap corruption could yield privilege escalation or system crash.

Technical ContextAI

The btrtl driver (Realtek Bluetooth) stores driver-private state in a 'struct btrealtek_data' appended to the hci_dev structure. When btrtl is paired with the btusb USB transport, btusb allocates extra private memory via hci_alloc_dev_priv. However, when btrtl is paired with the hci_h5 H5/Three-Wire UART transport (used in serial-attached Bluetooth on embedded platforms such as the Pine64 PinePhone), no equivalent allocation was made - leaving the private data pointer pointing beyond the allocated slab. The subsequent write of 8 bytes in btrtl_initialize (offset 0x6cc) to that unallocated address constitutes a slab-out-of-bounds write detected by KASAN. Although NVD classifies this as CWE-125 (Out-of-Bounds Read), the KASAN trace and the 'Buffer Overflow' tag confirm this is an out-of-bounds WRITE (more accurately CWE-787), which is a more severe root cause class. The affected CPE is cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* across multiple stable branches.

RemediationAI

Apply the upstream kernel fixes available at the following stable-tree commits: 0c657e641df1e77d6087688190f632cad9c0439b, 2f232bc389a4f5943c40733582f9edf77b89e499, dd163fa34c483f1674aa2510accce11a224f649e, and de4e88ec58c4202efd1f02eebb4939bbf6945358 (all at https://git.kernel.org/stable/c/). The fix adds the missing private-data memory allocation for the hci_h5 code path in btrtl. Distribution vendors (Debian, Ubuntu, RHEL, etc.) should be consulted for packaged kernel updates incorporating these commits. As a compensating control where patching is not immediately possible, administrators can prevent loading of the hci_uart kernel module on affected hardware via 'echo install hci_uart /bin/false >> /etc/modprobe.d/bluetooth-block.conf', though this disables all UART Bluetooth functionality on the device. No other targeted workaround is available since the flaw is in the driver initialization path itself.