# CVE-2025-39860: Linux Kernel use-after-free in Bluetooth l2cap_sock_cleanup_listen

Source: https://junglewise.ai/threats/cve-2025-39860-linux-kernel-use-after-free-in-bluetooth-l2cap-sock-cleanup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-19. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2025-39860 · Severity: high · CVSS 8 · Published 2025-09-19

A security vulnerability has been identified in the Linux kernel's Bluetooth subsystem, which is used to manage wireless connections. A flaw in how the system handles Bluetooth socket cleanup could allow an attacker to cause a system crash or potentially execute unauthorized code. This issue primarily impacts the stability and security of devices using Bluetooth, such as industrial networking equipment and general-purpose computers.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens RUGGEDCOM RST2428P](https://junglewise.ai/threats/technologies/ruggedcom-rst2428p). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-39860 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-39860 being exploited in the wild.

**How severe is CVE-2025-39860?** High severity, with a CVSS score of 8, published 19 September 2025.

**Which products and versions are affected?** Linux Kernel All versions prior to the September 2025 patches, Fixed in 6.11 and other stable branches.

**Is there a fix for CVE-2025-39860?** A patch was published on 2025-08-27: Initial patch authored by Google engineers Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-39860 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2025-39860?** Check whether you run Linux Kernel or Siemens RUGGEDCOM RST2428P at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel Bluetooth subsystem within the l2cap_sock_cleanup_listen() function. The root cause is a race condition where bt_accept_dequeue() can be called without proper socket locking during l2cap_sock_release(). This allows two threads to concurrently access and decrement the reference count of the same socket object; when the reference count hits zero prematurely, one thread may attempt to access the already-freed memory. The vulnerability was identified via syzbot and impacts systems using L2CAP sockets. Patches have been released for multiple stable kernel branches (e.g., 6.11, 6.6, 6.1) to ensure l2cap_sock_cleanup_listen() is called under lock_sock().

## Affected products

- Linux Linux Kernel Fixed in 6.11 and other stable branches
- Siemens RUGGEDCOM RST2428P

## Timeline

- 2025-08-27: patched: Initial patch authored by Google engineers
- 2025-09-09: patched: Patch committed to stable kernel trees
- 2025-09-19: disclosed: CVE published in NVD

## References

- [https://git.kernel.org/stable/c/2ca99fc3512a8074de20ee52a87b492dfcc41a4d](https://git.kernel.org/stable/c/2ca99fc3512a8074de20ee52a87b492dfcc41a4d)
- [https://git.kernel.org/stable/c/306b0991413b482dbf5585b423022123bb505966](https://git.kernel.org/stable/c/306b0991413b482dbf5585b423022123bb505966)
- [https://git.kernel.org/stable/c/3dff390f55ccd9ce12e91233849769b5312180c2](https://git.kernel.org/stable/c/3dff390f55ccd9ce12e91233849769b5312180c2)
- [https://git.kernel.org/stable/c/47f6090bcf75c369695d21c3f179db8a56bbbd49](https://git.kernel.org/stable/c/47f6090bcf75c369695d21c3f179db8a56bbbd49)
- [https://git.kernel.org/stable/c/6077d16b5c0f65d571eee709de2f0541fb5ef0ca](https://git.kernel.org/stable/c/6077d16b5c0f65d571eee709de2f0541fb5ef0ca)
- [https://git.kernel.org/stable/c/83e1d9892ef51785cf0760b7681436760dda435a](https://git.kernel.org/stable/c/83e1d9892ef51785cf0760b7681436760dda435a)
- [https://git.kernel.org/stable/c/862c628108562d8c7a516a900034823b381d3cba](https://git.kernel.org/stable/c/862c628108562d8c7a516a900034823b381d3cba)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)