Is CVE-2025-39860 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-39860 being exploited in the wild.

How severe is CVE-2025-39860?

High severity, with a CVSS score of 8, published 19 September 2025.

Which products and versions are affected?

Linux Kernel All versions prior to the September 2025 patches, Fixed in 6.11 and other stable branches.

Is there a fix for CVE-2025-39860?

A patch was published on 2025-08-27: Initial patch authored by Google engineers Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-39860 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2025-39860?

Check whether you run Linux Kernel or Siemens RUGGEDCOM RST2428P at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-39860: Linux Kernel use-after-free in Bluetooth l2cap_sock_cleanup_listen

CVE-2025-39860 · Severity: high · CVSS 8 · Published 2025-09-19

A security vulnerability has been identified in the Linux kernel's Bluetooth subsystem, which is used to manage wireless connections. A flaw in how the system handles Bluetooth socket cleanup could allow an attacker to cause a system crash or potentially execute unauthorized code. This issue primarily impacts the stability and security of devices using Bluetooth, such as industrial networking equipment and general-purpose computers.

Technologies: Linux Kernel, Siemens RUGGEDCOM RST2428P. Vendors: Linux, Siemens.

Quick answers

Is CVE-2025-39860 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-39860 being exploited in the wild.
How severe is CVE-2025-39860?: High severity, with a CVSS score of 8, published 19 September 2025.
Which products and versions are affected?: Linux Kernel All versions prior to the September 2025 patches, Fixed in 6.11 and other stable branches.
Is there a fix for CVE-2025-39860?: A patch was published on 2025-08-27: Initial patch authored by Google engineers Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-39860 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2025-39860?: Check whether you run Linux Kernel or Siemens RUGGEDCOM RST2428P at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel Bluetooth subsystem within the l2cap_sock_cleanup_listen() function. The root cause is a race condition where bt_accept_dequeue() can be called without proper socket locking during l2cap_sock_release(). This allows two threads to concurrently access and decrement the reference count of the same socket object; when the reference count hits zero prematurely, one thread may attempt to access the already-freed memory. The vulnerability was identified via syzbot and impacts systems using L2CAP sockets. Patches have been released for multiple stable kernel branches (e.g., 6.11, 6.6, 6.1) to ensure l2cap_sock_cleanup_listen() is called under lock_sock().

Affected products

Linux Linux Kernel Fixed in 6.11 and other stable branches
Siemens RUGGEDCOM RST2428P

Timeline

2025-08-27: patched: Initial patch authored by Google engineers
2025-09-09: patched: Patch committed to stable kernel trees
2025-09-19: disclosed: CVE published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.