CVE-2024-42137 addresses a vulnerability in the Linux kernel's Bluetooth subsystem specifically related to Qualcomm Atheros QCA6390 chipsets. The issue originated from a regression caused by a kernel commit (272970be3dab) intended to fix a use-after-free bug in the qca_serdev_shutdown() function. This fix introduced a new problem where Bluetooth (BT) could not be re-enabled after a sequence of operations: cold boot, enabling BT, disabling BT, followed by a warm reboot. The root cause was that the Virtual Serial Controller (VSC) command to reset the controller was not sent during warm reboot if the device tree (DT) or ACPI configuration lacked the enable-gpios property for QCA6390. This omission led to the Bluetooth controller remaining in an unreset state, causing BT enable failure. The regression was verified on a Dell XPS 13 9310 laptop. The final fix involved modifying qca_serdev_shutdown() to send the VSC reset command if Bluetooth had ever been enabled, ensuring the controller resets properly on warm reboot and preventing the use-after-free condition by keeping the serdev interface open until flushed or written. This vulnerability is specific to Linux kernel versions containing the faulty commits and affects systems using the QCA6390 Bluetooth chipset without proper DT/ACPI configuration. No known exploits are reported in the wild as of publication.

For European organizations, this vulnerability primarily impacts devices running Linux kernels with the affected commits and using Qualcomm QCA6390 Bluetooth chipsets, such as certain laptops (e.g., Dell XPS 13 9310). The impact is mainly operational rather than security-critical: Bluetooth functionality may fail to re-enable after a warm reboot, potentially disrupting wireless peripheral connectivity, device pairing, and related workflows. This could affect productivity in environments relying on Bluetooth devices for input, communication, or data transfer. Although no direct exploitation for privilege escalation or data compromise is indicated, the regression could lead to denial of Bluetooth service, impacting availability. In sectors like manufacturing, healthcare, or finance where Bluetooth devices are integrated into operational technology or secure environments, this could cause workflow interruptions. The lack of known exploits and the specificity of the hardware and configuration reduce the immediate risk, but organizations should be aware of potential operational disruptions and plan updates accordingly.

Organizations should ensure their Linux systems are updated to kernel versions containing the fix that sends the VSC reset command during qca_serdev_shutdown(). Specifically, applying the commits referenced (including 272970be3dab and subsequent fixes) is critical. For systems using QCA6390 chipsets, verify that device tree (DT) or ACPI configurations include the enable-gpios property to avoid the regression scenario. System administrators should audit their Linux kernel versions and Bluetooth driver states on affected hardware, particularly laptops like Dell XPS 13 9310, and prioritize patching. In environments where immediate patching is not feasible, consider workarounds such as avoiding warm reboot sequences that disable and re-enable Bluetooth or using cold boots to reset the controller state. Monitoring Bluetooth functionality post-reboot can help detect the issue early. Additionally, coordinate with hardware vendors and Linux distribution maintainers to confirm the presence of fixes in distribution kernels and backport patches if necessary.