Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem that could allow an attacker to crash the system or potentially execute unauthorized code. The issue occurs when the system incorrectly handles Bluetooth connection requests, leading to a memory error known as a use-after-free. This could impact the reliability of devices using Bluetooth and potentially compromise the security of the operating system.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel Bluetooth stack within the hci_acl_create_conn_sync and hci_le_create_conn_sync functions. The flaw is triggered when a connection object in the BT_OPEN state is freed while a command submission is still pending. An attacker within Bluetooth range (adjacent network) could exploit this race condition to trigger a slab-use-after-free, as evidenced by KASAN reports showing a write of size 2 at a freed address. The issue has been addressed in the stable kernel branches by ensuring proper synchronization and reference counting during connection creation.
Affected products
- Linux Linux Kernel 6.16-rc7 and earlier versions
Timeline
- 2025-08-25: disclosed: Patch authored by Luiz Augusto von Dentz
- 2025-10-02: patched: Commits merged into stable branches by Greg Kroah-Hartman
- 2025-10-15: advisory: CVE-2025-39982 published
References
- https://git.kernel.org/stable/c/484c7d571a3d1b3fd298fa691b660438c4548a53
- https://git.kernel.org/stable/c/6243bda271a628c48875e3e473206e7f584892ce
- https://git.kernel.org/stable/c/9e622804d57e2d08f0271200606bd1270f75126f
- https://git.kernel.org/stable/c/a78fd4fc5694ecb3b97deb2ad9eaebd67b4d2b08
- https://git.kernel.org/stable/c/bcce99f613163a43de24674b717e7a6c135fc879