Executive brief
A vulnerability in the Linux kernel's Bluetooth subsystem could allow an attacker in physical proximity to cause a system crash or potentially access sensitive information. The issue occurs when the system processes a specific type of Bluetooth command response that is malformed or unexpected. This can lead to the system reading uninitialized memory, resulting in unpredictable behavior or a denial of service.
Technical details
A flaw exists in the hci_cmd_complete_evt() function within net/bluetooth/hci_event.c of the Linux kernel. When a Bluetooth Command Complete event with an unknown opcode is received, the kernel attempts to read the return status from the first byte of the socket buffer (skb) data. However, if the data has already been consumed by hci_event_func(), the buffer may be empty, leading to an out-of-bounds read of uninitialized memory. An attacker within Bluetooth range can exploit this by sending crafted packets to trigger a kernel panic or leak information. Patches have been released for various stable branches including 6.1.x, 6.6.x, 6.12.x, and 6.17.x.
Affected products
- Linux Linux Kernel 6.1 to 6.1.159, 6.6 to 6.6.117, 6.12 to 6.12.58, 6.17 to 6.17.8
Timeline
- 2025-10-24: other: Vulnerability reported by syzbot
- 2025-10-31: patched: Fix committed to mainline kernel
- 2025-12-08: advisory: CVE-2025-40301 published
References
- https://git.kernel.org/stable/c/1a0ddaaf97405dbd11d4cb5a961a3f82400e8a50
- https://git.kernel.org/stable/c/5c5f1f64681cc889d9b13e4a61285e9e029d6ab5
- https://git.kernel.org/stable/c/779f83a91d4f1bf5ddfeaf528420cbb6dbf03fa8
- https://git.kernel.org/stable/c/cf2c2acec1cf456c3d11c11a7589e886a0f963a9
- https://git.kernel.org/stable/c/fea895de78d3bb2f0c09db9f10b18f8121b15759