Executive brief
A vulnerability in the Linux kernel's Bluetooth component could allow an attacker to crash the system or potentially execute unauthorized code. The issue occurs when the system handles specific Bluetooth audio connections (ISO sockets) and fails to properly clean up memory after a connection is closed. This could lead to a system instability or a security breach if an attacker is within Bluetooth range.
Technical details
A use-after-free (UAF) vulnerability exists in the net/bluetooth/iso.c component of the Linux kernel. The root cause is a failure to set the socket pointer (conn->sk) to NULL within the iso_conn_free function when a socket is killed. This allows a dangling pointer to be accessed after the associated memory has been freed. An attacker with adjacent network access (Bluetooth range) and low privileges could exploit this during the teardown of BTPROTO_ISO sockets. The issue has been resolved by ensuring the connection socket pointer is properly nullified in iso_sock_kill. Fixes are available in stable kernel branches including 6.1.156, 6.6.112, 6.12.53, and 6.17.3.
Affected products
- Linux Linux Kernel 6.0 to 6.17.3
Timeline
- 2025-09-22: patched: Initial fix authored by Luiz Augusto von Dentz
- 2025-11-12: disclosed: CVE-2025-40141 published
References
- https://git.kernel.org/stable/c/5319145a07d8bf5b0782b25cb3115825689d42bb
- https://git.kernel.org/stable/c/80689777919f02328eb873769de4647c9dd3e371
- https://git.kernel.org/stable/c/9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8
- https://git.kernel.org/stable/c/c92ad1a155ccfa38b87bd1d998287e1c0a24248d
- https://git.kernel.org/stable/c/eba6d787ec117a5d2c60f9644e0a39c18542b6be