{"id":"CVE-2024-58238","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart: Resolve TX timeout error in power save stress test\n\nThis fixes the tx timeout issue seen while running a stress test on\nbtnxpuart for couple of ho…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart: Resolve TX timeout error in power save stress test\n\nThis fixes the tx timeout issue seen while running a stress test on\nbtnxpuart for couple of ho…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.4, < 6.6.49","linux_kernel >= 6.7, < 6.9"],"patched":["linux_kernel 6.9"],"published":"2025-08-09","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:18:06.317","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-58238","references":[{"url":"https://git.kernel.org/stable/c/9d5df94ce0e213d5b549633f528f96114c736190","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e4db90e4eb8d5487098712ffb1048f3fa6d25e98","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00162,"epssPercentile":0.05369,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T21:42:26.221437Z"},"ingestedAt":"2026-10-15T22:48:25.466Z","slug":"CVE-2024-58238","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart: Resolve TX timeout error in power save stress test\n\nThis fixes the tx timeout issue seen while running a stress test on\nbtnxpuart for couple of hours, such that the interval between two HCI\ncommands coincide with the power save timeout value of 2 seconds.\n\nTest procedure using bash script:\n<load btnxpuart.ko>\nhciconfig hci0 up\n//Enable Power Save feature\nhcitool -i hci0 cmd 3f 23 02 00 00\nwhile (true)\ndo\n    hciconfig hci0 leadv\n    sleep 2\n    hciconfig hci0 noleadv\n    sleep 2\ndone\n\nError log, after adding few more debug prints:\nBluetooth: btnxpuart_queue_skb(): 01 0A 20 01 00\nBluetooth: hci0: Set UART break: on, status=0\nBluetooth: hci0: btnxpuart_tx_wakeup() tx_work scheduled\nBluetooth: hci0: btnxpuart_tx_work() dequeue: 01 0A 20 01 00\nCan't set advertise mode on hci0: Connection timed out (110)\nBluetooth: hci0: command 0x200a tx timeout\n\nWhen the power save mechanism turns on UART break, and btnxpuart_tx_work()\nis scheduled simultaneously, psdata->ps_state is read as PS_STATE_AWAKE,\nwhich prevents the psdata->work from being scheduled, which is responsible\nto turn OFF UART break.\n\nThis issue is fixed by adding a ps_lock mutex around UART break on/off as\nwell as around ps_state read/write.\nbtnxpuart_tx_wakeup() will now read updated ps_state value. If ps_state is\nPS_STATE_SLEEP, it will first schedule psdata->work, and then it will\nreschedule itself once UART break has been turned off and ps_state is\nPS_STATE_AWAKE.\n\nTested above script for 50,000 iterations and TX timeout error was not\nobserved anymore.\n\n## Affected\n\n- `linux_kernel >= 6.4, < 6.6.49`\n- `linux_kernel >= 6.7, < 6.9`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.9`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}