Executive brief
A vulnerability in the Linux kernel's Bluetooth 6LoWPAN implementation can cause a system crash (kernel BUG) when processing certain IPv6 network packets. This component is typically used to allow low-power Bluetooth devices to communicate over the internet using IPv6. An attacker within Bluetooth range could potentially exploit this to disrupt service or gain unauthorized access to the system.
Technical details
The vulnerability exists in 'net/bluetooth/6lowpan.c' within the Linux kernel. The 6LoWPAN netdev implementation utilizes 'header_ops' but fails to call 'skb_reset_mac_header()' for uncompressed IPv6 RX paths. This omission causes a kernel BUG at 'net/core/skbuff.c:212' when processing packets, particularly when using 'AF_PACKET SOCK_RAW'. An adjacent attacker can trigger this crash by sending specially crafted IPv6 packets over a Bluetooth LE connection. The issue has been resolved by adding the missing 'skb_reset_mac_header()' call in the 'recv_pkt' function.
Affected products
- Linux Linux Kernel 3.14 to 6.12.x
Timeline
- 2025-11-03: patched: Initial patch authored by Pauli Virtanen
- 2025-12-06: disclosed: CVE-2025-40282 published
References
- https://git.kernel.org/stable/c/11cd7e068381666f842ad41d1cc58eecd0c75237
- https://git.kernel.org/stable/c/3b78f50918276ab28fb22eac9aa49401ac436a3b
- https://git.kernel.org/stable/c/4ebb90c3c309e6375dc3e841af92e2a039843e62
- https://git.kernel.org/stable/c/70d84e7c3a44b81020a3c3d650a64c63593405bd
- https://git.kernel.org/stable/c/973e0271754c77db3e1b6b69adf2de85a79a4c8b
- https://git.kernel.org/stable/c/c24ac6cfe4f9a47180a65592c47e7a310d2f9d93
- https://git.kernel.org/stable/c/d566e9a2bfc848941b091ffd5f4e12c4e889d818