Executive brief
A security vulnerability has been identified in the Linux kernel's Bluetooth subsystem, which is used to manage wireless connections. A flaw in how the system handles Bluetooth socket cleanup could allow an attacker to cause a system crash or potentially execute unauthorized code. This issue primarily impacts the stability and security of devices using Bluetooth, such as industrial networking equipment and general-purpose computers.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel Bluetooth subsystem within the l2cap_sock_cleanup_listen() function. The root cause is a race condition where bt_accept_dequeue() can be called without proper socket locking during l2cap_sock_release(). This allows two threads to concurrently access and decrement the reference count of the same socket object; when the reference count hits zero prematurely, one thread may attempt to access the already-freed memory. The vulnerability was identified via syzbot and impacts systems using L2CAP sockets. Patches have been released for multiple stable kernel branches (e.g., 6.11, 6.6, 6.1) to ensure l2cap_sock_cleanup_listen() is called under lock_sock().
Affected products
- Linux Linux Kernel Fixed in 6.11 and other stable branches
- Siemens RUGGEDCOM RST2428P
Timeline
- 2025-08-27: patched: Initial patch authored by Google engineers
- 2025-09-09: patched: Patch committed to stable kernel trees
- 2025-09-19: disclosed: CVE published in NVD
References
- https://git.kernel.org/stable/c/2ca99fc3512a8074de20ee52a87b492dfcc41a4d
- https://git.kernel.org/stable/c/306b0991413b482dbf5585b423022123bb505966
- https://git.kernel.org/stable/c/3dff390f55ccd9ce12e91233849769b5312180c2
- https://git.kernel.org/stable/c/47f6090bcf75c369695d21c3f179db8a56bbbd49
- https://git.kernel.org/stable/c/6077d16b5c0f65d571eee709de2f0541fb5ef0ca
- https://git.kernel.org/stable/c/83e1d9892ef51785cf0760b7681436760dda435a
- https://git.kernel.org/stable/c/862c628108562d8c7a516a900034823b381d3cba