Executive brief
A vulnerability in the Linux kernel's Bluetooth component could allow a local user to cause a system crash or potentially execute unauthorized actions. The issue occurs when Bluetooth mesh networking hardware is removed while certain internal timers are still running, leading to memory corruption. This could impact system stability and availability in environments using Bluetooth Mesh features.
Technical details
A use-after-free (UAF) vulnerability exists in net/bluetooth/mgmt.c within the Linux kernel. The root cause is a failure to cancel the 'mesh_send_done' delayed work timer when a Bluetooth host controller interface device (hdev) is removed via mgmt_index_removed. If the timer expires after the device structure has been freed, the kernel attempts to access the deallocated memory, resulting in a slab-use-after-free in run_timer_softirq. This is a local attack vector requiring no special user interaction. Patches have been released for multiple stable kernel branches (6.1.y, 6.6.y, 6.12.y, 6.17.y) to ensure the timer is synchronized and canceled during device removal.
Affected products
- Linux Linux Kernel 6.1 to 6.1.159, 6.6 to 6.6.117, 6.12 to 6.12.59, 6.17 to 6.17.9
Timeline
- 2025-12-06: advisory: Initial disclosure of CVE-2025-40284
- 2025-11-24: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/2927ff643607eddf4f03d10ef80fe10d977154aa
- https://git.kernel.org/stable/c/55fb52ffdd62850d667ebed842815e072d3c9961
- https://git.kernel.org/stable/c/7b6b6c077cad0601d62c3c34ab7ce3fb25deda7b
- https://git.kernel.org/stable/c/990e6143b0ca0c66f099d67d00c112bf59b30d76
- https://git.kernel.org/stable/c/fd62ca5ad136dcf6f5aa308423b299a6be6f54ea