CVE-2024-41062 is a medium severity use-after-free vulnerability in the Linux kernel Bluetooth L2CAP code. The flaw occurs due to a race condition between the sock_close system call releasing the socket and the hci_rx_work thread accessing the socket's receive callback without proper locking. If the receive callback accesses the socket after it has been freed, it can cause a denial of service. The patch adds a channel mutex in the receive callback to synchronize socket release and reception, and sets channel data to NULL when the socket is dead to avoid use of invalid pointers.

This vulnerability can cause a denial of service (DoS) by allowing the kernel to access freed memory when processing Bluetooth L2CAP data. There is no impact on confidentiality or integrity reported. Exploitation requires local privileges and user interaction is not needed.

A fix has been applied to the Linux kernel to add proper synchronization between socket release and receive callbacks in the Bluetooth L2CAP subsystem. Users and administrators should update to the patched kernel version once available. Patch status is not explicitly stated in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply updates accordingly.