Junglewise Threat Intelligence

CVE-2025-40282: Linux Kernel Bluetooth 6LoWPAN denial of service in IPv6 reception

CVE-2025-40282 · Severity: high · CVSS 8.8 · Published 2025-12-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Bluetooth 6LoWPAN implementation can cause a system crash (kernel BUG) when processing certain IPv6 network packets. This component is typically used to allow low-power Bluetooth devices to communicate over the internet using IPv6. An attacker within Bluetooth range could potentially exploit this to disrupt service or gain unauthorized access to the system.

Technical details

The vulnerability exists in 'net/bluetooth/6lowpan.c' within the Linux kernel. The 6LoWPAN netdev implementation utilizes 'header_ops' but fails to call 'skb_reset_mac_header()' for uncompressed IPv6 RX paths. This omission causes a kernel BUG at 'net/core/skbuff.c:212' when processing packets, particularly when using 'AF_PACKET SOCK_RAW'. An adjacent attacker can trigger this crash by sending specially crafted IPv6 packets over a Bluetooth LE connection. The issue has been resolved by adding the missing 'skb_reset_mac_header()' call in the 'recv_pkt' function.

Affected products

  • Linux Linux Kernel 3.14 to 6.12.x

Timeline

  • 2025-11-03: patched: Initial patch authored by Pauli Virtanen
  • 2025-12-06: disclosed: CVE-2025-40282 published

References

Related threats