Skip to main content

Linux Kernel CVE-2025-40213

HIGH
2025-11-24 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.6 MEDIUM

Local MGMT socket needs CAP_NET_ADMIN (PR:L, AV:L); primary impact is kernel crash (A:H) with limited stack OOB read/corruption (C:L/I:L), no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Updated
Jul 30, 2026 - 08:15 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Analysis Generated
Mar 28, 2026 - 19:23 vuln.today
CVE Published
Nov 24, 2025 - 16:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete

There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to memcpy from badly declared on-stack flexible array.

Another crash is in set_mesh_complete() due to double list_del via mgmt_pending_valid + mgmt_pending_remove.

Use DEFINE_FLEX to declare the flexible array right, and don't memcpy outside bounds.

As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free, and also report status on error.

AnalysisAI

Local privilege-holders can crash the Linux kernel through the Bluetooth Management (MGMT) interface, where the set_mesh_sync handler performs a memcpy against an improperly declared on-stack flexible array, triggering a KASAN-detected stack-out-of-bounds access. A companion defect in set_mesh_complete() causes a double list_del (via mgmt_pending_valid followed by mgmt_pending_remove), corrupting kernel list state. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and the flaw is not on CISA KEV; it is fixed in the mainline/stable Bluetooth mesh code.

Technical ContextAI

The vulnerability lives in the Bluetooth subsystem's userspace-facing Management (MGMT) protocol, specifically the mesh receiver configuration path (MGMT_OP_SET_MESH_RECEIVER handling in net/bluetooth/mgmt.c). The root cause is a mis-declared on-stack flexible array member combined with an unchecked memcpy, so attacker-controlled length/data drives a read/write past the intended stack buffer - a classic out-of-bounds (CWE-787/CWE-125 family, though the NVD CWE is marked N/A). A second issue is a use-after-removal/double-free-style list corruption: set_mesh_complete() calls mgmt_pending_valid (which already unlinks the command) and then mgmt_pending_remove, performing list_del twice on the same node. The fix uses DEFINE_FLEX to size the flexible array correctly, bounds the memcpy, and switches to mgmt_pending_free plus proper error-status reporting.

Affected ProductsAI

The affected product is the Linux kernel Bluetooth subsystem (net/bluetooth/mgmt.c) mesh handling, on kernel versions that introduced the MGMT set-mesh-receiver code prior to the fix commits. Exact vulnerable version ranges are not enumerated in the provided NVD data (no CPE strings supplied); affected builds should be identified by the presence of the pre-fix set_mesh_sync/set_mesh_complete code. Fix commits are published in the kernel stable tree: git.kernel.org/stable/c/1c9aca1787e8395a2c59fef20e914467958969c5, .../5c19daa93d9af29f1f46251b47e1ea66bcc8d679, and .../e8785404de06a69d89dcdd1e9a0b6ea42dc6d327.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update that includes the three stable commits (1c9aca1787e8, 5c19daa93d9a, e8785404de06) from git.kernel.org, or the corresponding fixed package from your distribution once it ships. Until patched, reduce exposure by limiting who can issue Bluetooth MGMT commands: restrict CAP_NET_ADMIN, unload/blacklist the Bluetooth stack (modprobe blacklist bluetooth / rmmod) on systems that do not need it, and disable the experimental Bluetooth mesh feature if enabled - trade-off being loss of all Bluetooth or mesh functionality on that host. On servers and appliances with no Bluetooth requirement, disabling the subsystem entirely is the lowest-risk compensating control.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected

Share

CVE-2025-40213 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy