Skip to main content

Linux Kernel CVE-2025-40141

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.0
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.0 HIGH
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.1 HIGH

Adjacent Bluetooth range (AV:A) and race-condition timing raise complexity to AC:H; some connection/local privilege gives PR:L; kernel UAF yields full C/I/A impact.

3.1 AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Red Hat
7.3 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 30, 2026 - 09:01 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 09:01 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
8.0 (HIGH)
Patch released
Mar 28, 2026 - 19:31 nvd
Patch available
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 11:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Fix possible UAF on iso_conn_free

This attempt to fix similar issue to sco_conn_free where if the conn->sk is not set to NULL may lead to UAF on iso_conn_free.

AnalysisAI

Memory corruption in the Linux kernel Bluetooth Isochronous (ISO) channel subsystem allows a use-after-free when iso_conn_free() runs without conn->sk being cleared to NULL, mirroring a previously fixed SCO flaw. An attacker within Bluetooth range able to establish or tear down ISO connections can trigger the dangling-pointer condition to corrupt kernel memory, potentially escalating privileges or crashing the host. It carries a CVSS 8.0 (high) score; no public exploit has been identified and EPSS is very low (0.03%), indicating no observed exploitation activity.

Technical ContextAI

The flaw lives in the Bluetooth Low Energy Isochronous Channels (ISO) socket layer of the Linux kernel net/bluetooth stack, used for LE Audio and connected/broadcast isochronous streams. The connection object (iso_conn) holds a back-pointer to its owning socket (conn->sk); if that pointer is not reset to NULL during teardown, iso_conn_free() can dereference or free memory that has already been released, a classic use-after-free (CWE-416). The fix replicates the earlier remediation applied to the analogous SCO path (sco_conn_free), ensuring the socket reference is nulled before the connection structure is released. Because it is a kernel-space object-lifetime bug, successful triggering operates with the kernel's own privileges.

Affected ProductsAI

The vulnerability affects the Linux kernel's Bluetooth ISO subsystem across multiple stable branches; the specific vulnerable/fixed boundaries are defined by the five kernel.org stable commits (5319145a07d8, 8068977791​9f, 9950f095d6c8, c92ad1a155cc, eba6d787ec11) rather than a single version string, so exact affected ranges should be read from each stable tree. Distribution-level exposure is confirmed for Ubuntu, with fixes tracked in Ubuntu advisories USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1). No CPE strings were supplied in the input, so precise vendor/version enumeration should be validated against each distribution's kernel package metadata.

RemediationAI

Apply the vendor kernel update: Patch available per vendor advisory - upstream fix is available as the kernel.org stable commits 5319145a07d8bf5b0782b25cb3115825689d42bb, 80689777919f02328eb873769de4647c9dd3e371, 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8, c92ad1a155ccfa38b87bd1d998287e1c0a24248d, and eba6d787ec117a5d2c60f9644e0a39c18542b6be. Ubuntu users should upgrade to the fixed kernel packages per USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1) and reboot into the new kernel. If patching must be deferred, a concrete compensating control is to disable Bluetooth on affected hosts (e.g. rmmod/blacklist the bluetooth and related ISO modules, or systemctl disable --now bluetooth), which fully removes the attack surface at the cost of losing LE Audio/isochronous and other Bluetooth functionality; where Bluetooth is required, restrict pairing and keep devices out of untrusted radio environments to limit an adjacent attacker's ability to drive ISO connection setup and teardown.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.114 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.82 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.116 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.55 Affected

Share

CVE-2025-40141 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy