Executive brief
A vulnerability in the Linux kernel's Bluetooth subsystem could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs during Bluetooth service discovery, where a specific internal data structure can be deleted twice due to a timing conflict. This could lead to a complete system failure (kernel panic) or be used as a stepping stone for further attacks on the operating system.
Technical details
A race condition exists in the 'hci_discovery_filter_clear()' function within the Bluetooth HCI implementation of the Linux kernel. The function frees the 'uuids' array and subsequently sets the pointer to NULL; however, if the process is preempted between these two operations, a concurrent call to 'start_service_discovery()' can trigger a second 'kfree()' on the same memory address. This double free occurs because of a lack of proper synchronization/locking around the deallocation logic. A local attacker with access to Bluetooth sockets could exploit this race to trigger a kernel BUG at mm/slub.c, leading to a Denial of Service (DoS) or potentially arbitrary code execution in kernel context. The fix introduces a spinlock to ensure the kfree and NULL assignment are performed atomically.
Affected products
- Linux Linux Kernel 5.17 to 6.1.159, 6.6.117, 6.12.42, 6.15.10
Timeline
- 2025-08-19: disclosed: CVE published
- 2025-07-23: patched: Initial patch committed to mainline
References
- https://git.kernel.org/stable/c/16852eccbdfaf41a666705e3f8be55cf2864c5ca
- https://git.kernel.org/stable/c/2935e556850e9c94d7a00adf14d3cd7fe406ac03
- https://git.kernel.org/stable/c/7ce9bb0b95fc280e9212b8922590c492ca1d9c39
- https://git.kernel.org/stable/c/86f3dcd1f331cfd4fd7ec88906955134ec51afbe
- https://git.kernel.org/stable/c/a351ff6b8ecca4229afaa0d98042bead8de64799
- https://git.kernel.org/stable/c/f8069f34c4c976786ded97498012225af87435d7