CVE-2024-46680 is a vulnerability identified in the Linux kernel specifically affecting the Bluetooth btnxpuart driver. The issue arises from improper handling of scheduled work during the removal of the btnxpuart kernel module. When the driver is loaded and unloaded repeatedly, the ps_wakeup() function in btnxpuart_close() schedules a work item (psdata->work()) that may execute after the module has been removed. This results in a use-after-free condition causing a kernel crash (kernel oops) due to accessing invalid memory. The problem became apparent after the Power Save feature was enabled by default in the btnxpuart driver, which introduced asynchronous work scheduling related to power management. The fix involves the introduction of a ps_cleanup() function that immediately deasserts the UART break signal upon closing the serdev device, cancels any scheduled work, and destroys the associated mutex to prevent work from executing after module removal. The vulnerability manifests as a random kernel crash during repeated load/unload cycles of the btnxpuart driver, which can be reproduced with the sequence: modprobe btnxpuart, hciconfig hci0 reset, verifying the hci0 interface, and modprobe -r btnxpuart. The kernel crash logs indicate a kernel paging fault due to a level 3 translation fault, confirming invalid memory access. This vulnerability affects Linux kernel versions including and after v6.9.11 and is present in builds identified by the given commit hashes. There are no known exploits in the wild at this time, and no CVSS score has been assigned yet. The vulnerability is primarily a stability and availability issue caused by a race condition in Bluetooth driver power management code.

For European organizations, the impact of CVE-2024-46680 is primarily on system stability and availability rather than confidentiality or integrity. Systems running Linux kernels with the vulnerable btnxpuart Bluetooth driver may experience random kernel crashes during driver unload operations, which could lead to service interruptions or system reboots. This is particularly relevant for embedded systems, IoT devices, industrial control systems, or any Linux-based infrastructure that relies on Bluetooth connectivity and performs dynamic driver management. Organizations using Linux in critical environments such as manufacturing, healthcare, transportation, or telecommunications could face operational disruptions. Although this vulnerability does not directly enable privilege escalation or remote code execution, repeated kernel crashes can degrade system reliability and potentially cause denial of service conditions. Since the issue is triggered by module unload/load cycles, it is less likely to be exploited remotely but could be triggered by local users or automated system processes. The lack of known exploits reduces immediate risk, but unpatched systems remain vulnerable to stability issues.

European organizations should apply the official Linux kernel patches that address CVE-2024-46680 as soon as they become available. Specifically, updating to Linux kernel versions including the fix (post v6.9.11) will prevent the race condition causing the kernel crash. Until patches are deployed, organizations should avoid repeatedly loading and unloading the btnxpuart driver, especially in automated test or power management scenarios. Systems that do not require Bluetooth btnxpuart functionality should consider disabling or blacklisting the driver to eliminate exposure. For embedded or IoT devices, firmware updates incorporating the patched kernel should be prioritized. Monitoring kernel logs for signs of the described paging faults or oops messages can help detect attempts to trigger the vulnerability. Additionally, organizations should implement robust system monitoring and automated reboot mechanisms to minimize downtime from unexpected kernel crashes. Coordination with Linux distribution vendors to receive timely security updates is critical. Finally, reviewing power management configurations related to Bluetooth devices to avoid unnecessary driver reloads can reduce risk.