Executive brief
A vulnerability in the Linux kernel's Bluetooth subsystem could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when the system attempts to clean up Bluetooth device data while that data is still being accessed by another process. This race condition can lead to a system instability or a complete crash, impacting the availability of the device.
Technical details
A use-after-free (UAF) vulnerability exists in the Bluetooth HCI core, specifically within the vhci_flush() function. The flaw is rooted in a lack of synchronization in hci_unregister_dev() after unlinking a device from the hci_dev_list. If one thread closes a vhci file descriptor (triggering vhci_release and subsequent kfree of driver_data) while another thread is concurrently executing an ioctl() request on the same device, the second thread may access memory that has already been freed. The fix introduces Sleepable Read-Copy-Update (SRCU) to ensure that device reset operations complete and in-flight requests are accounted for before the device data is deallocated.
Affected products
- Linux Linux Kernel 6.7 to 6.12.36, 6.13 to 6.15.5, 6.16-rc1
Timeline
- 2025-07-09: advisory: CVE-2025-38250 published
References
- https://git.kernel.org/stable/c/0e5c144c557df910ab64d9c25d06399a9a735e65
- https://git.kernel.org/stable/c/1d6123102e9fbedc8d25bf4731da6d513173e49e
- https://git.kernel.org/stable/c/90dee0a0ff84fac8accd5be98412b3819f667149
- https://git.kernel.org/stable/c/bc0819a25e04cd68ef3568cfa51b63118fea39a7
- https://git.kernel.org/stable/c/c56b177efce8b62798e4d96bdb9867106cb7c4a0
- https://git.kernel.org/stable/c/ce23b73f0f27e2dbeb81734a79db710f05aa33c6