Skip to main content

Linux Kernel CVE-2025-40318

| EUVDEUVD-2025-201627 HIGH
2025-12-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.9 MEDIUM

Winning a kernel work-queue race is timing-dependent (AC:H) and driving HCI command-sync activity realistically needs local/Bluetooth interaction (PR:L); most reliable outcome is a crash (A:H) with limited C/I.

3.1 AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
8.8 (HIGH)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 17:54 euvd
EUVD-2025-201627
Analysis Generated
Mar 15, 2026 - 17:54 vuln.today
CVE Published
Dec 08, 2025 - 01:16 cve.org
HIGH 8.8
CVE Published
Dec 08, 2025 - 01:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once

hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF".

Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.

AnalysisAI

A use-after-free condition in the Linux kernel's Bluetooth HCI command-synchronization layer (hci_sync) lets a race between hci_cmd_sync_dequeue_once() and hci_cmd_sync_work() delete the same list entry twice, corrupting kernel memory. It affects the mainline Linux kernel Bluetooth stack up to the fixed stable releases (6.1.159, 6.6.117, 6.12.58, 6.17.8) and is fixed upstream. There is no public exploit identified and EPSS is very low (0.04%), but the NVD-scored CVSS of 8.8 reflects the high-impact memory-corruption potential (denial of service and possible privilege escalation) if the race is won.

Technical ContextAI

The flaw lives in the Bluetooth HCI command-sync framework (net/bluetooth/hci_sync.c). hci_cmd_sync_dequeue_once() performed lookup and cancellation of a queued command entry in two separate critical sections protected by cmd_sync_work_lock. Between those sections, the asynchronous worker hci_cmd_sync_work() could dequeue and free the same entry, so the dequeue path then called list_del() on an already-removed/freed node - a classic double list_del() producing a use-after-free. Although the input reports CWE as N/A, this maps to CWE-416 (Use After Free) driven by CWE-362 (concurrent execution using a shared resource without proper synchronization / race condition). The fix widens the lock to hold cmd_sync_work_lock across both the lookup and the cancel so the entry cannot be removed concurrently.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux stable release - 6.1.159, 6.6.117, 6.12.58, or 6.17.8 (fix also in 6.18), or apply the corresponding upstream stable commits listed at git.kernel.org (e.g. https://git.kernel.org/stable/c/932c0a4f77ac13e526fdd5b42914d29c9821d389). Distribution users should install the vendor kernel update; Ubuntu users should apply USN-8095-1 (https://ubuntu.com/security/notices/USN-8095-1) and reboot. If patching must be deferred and Bluetooth is not required, a strong compensating control is to disable and unload the Bluetooth stack (e.g. stop bluetoothd and 'modprobe -r bluetooth' / blacklist the module), which fully removes exposure but breaks all Bluetooth functionality; alternatively restrict physical/radio proximity and disable Bluetooth on unattended or exposed devices to reduce the adjacent attack surface.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-40318 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy