Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem that could lead to system instability or unauthorized memory access. The issue occurs when the system attempts to manage Bluetooth command queues, potentially allowing a race condition that crashes the system or allows for a use-after-free exploit. This could impact any device using affected versions of the Linux kernel with Bluetooth enabled, potentially allowing an attacker within Bluetooth range to compromise the system.
Technical details
A race condition exists in the Bluetooth hci_sync component of the Linux kernel, specifically within the hci_cmd_sync_dequeue_once() function. The function performed a lookup and a subsequent cancellation of a queue entry under two separate lock sections, allowing hci_cmd_sync_work() to delete the same entry in between these operations. This results in a double list_del() and a use-after-free (UAF) condition. An attacker within Bluetooth range (adjacent) could potentially exploit this to cause a kernel panic or execute arbitrary code. The fix involves extending the cmd_sync_work_lock to cover both the lookup and cancellation operations atomically.
Affected products
- Linux Linux Kernel 6.1.120 to 6.1.159, 6.6.51 to 6.6.117, 6.8.9 to 6.9, and 6.9 to 6.12.58
Timeline
- 2025-12-08: advisory: CVE-2025-40318 published by NVD
- 2025-12-07: patched: Fixes merged into various stable kernel branches
References
- https://git.kernel.org/stable/c/09b0cd1297b4dbfe736aeaa0ceeab2265f47f772
- https://git.kernel.org/stable/c/0a94f7e017438935c09ef833a1aa908ad9875213
- https://git.kernel.org/stable/c/932c0a4f77ac13e526fdd5b42914d29c9821d389
- https://git.kernel.org/stable/c/9cd536970192b72257afcdfba0bfc09993e6f19c
- https://git.kernel.org/stable/c/ae76cf6c2c842944c6514c57df54d728f1916553