Skip to main content

Linux Kernel EUVDEUVD-2025-201644

| CVE-2025-40301 HIGH
2025-12-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.6
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.6 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
vuln.today AI
5.4 MEDIUM

Adjacent Bluetooth transport (AV:A) with no privileges, but impact is a single uninitialized-byte leak (C:L) and at most minor command-handling disruption (A:L), not high availability loss.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Red Hat
7.1 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.6 (HIGH)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 17:54 euvd
EUVD-2025-201644
Analysis Generated
Mar 15, 2026 - 17:54 vuln.today
CVE Published
Dec 08, 2025 - 01:16 cve.org
HIGH 7.6
CVE Published
Dec 08, 2025 - 01:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_event: validate skb length for unknown CC opcode

In hci_cmd_complete_evt(), if the command complete event has an unknown opcode, we assume the first byte of the remaining skb->data contains the return status. However, parameter data has previously been pulled in hci_event_func(), which may leave the skb empty. If so, using skb->data[0] for the return status uses un-init memory.

The fix is to check skb->len before using skb->data.

AnalysisAI

Uninitialized memory read in the Linux kernel Bluetooth HCI event layer allows a malicious or malfunctioning Bluetooth controller to leak a byte of kernel memory and induce undefined command-completion handling. The flaw lives in hci_cmd_complete_evt(), where an unknown Command Complete opcode causes the code to read skb->data[0] as a return status even after all parameter bytes were already pulled, leaving the buffer empty. It is a fixed upstream kernel bug (CWE-908-class use of uninitialized resource) with no public exploit identified at time of analysis and a very low EPSS score of 0.04%.

Technical ContextAI

The vulnerability is in the kernel's Bluetooth HCI (Host Controller Interface) event-handling path, net/bluetooth/hci_event.c. When the host receives a Command Complete event, hci_event_func() first pulls the fixed event parameters off the socket buffer (skb), then hci_cmd_complete_evt() inspects the remaining data. For a recognized opcode the handler consumes the expected structure, but for an unknown opcode the code falls back to treating skb->data[0] as the command return status. If the earlier pull left the skb empty, that dereference reads uninitialized/stale memory rather than a valid status byte. The root cause is a missing length validation (skb->len is not checked before indexing skb->data), a classic use-of-uninitialized-memory bug even though NVD lists CWE as N/A. Because HCI events originate from the Bluetooth controller/link, the trust boundary is the adjacent Bluetooth transport rather than the general network.

RemediationAI

Vendor-released patch: upgrade to Linux kernel 6.1.159, 6.6.117, 6.12.58, 6.17.8, or 6.18 (or later) matching your branch; the fix simply adds a skb->len check before reading skb->data. Distribution users on Ubuntu should apply the kernel update per USN-8095-1 (https://ubuntu.com/security/notices/USN-8095-1) and reboot into the patched kernel. The upstream commits are available at git.kernel.org (e.g. https://git.kernel.org/stable/c/1a0ddaaf97405dbd11d4cb5a961a3f82400e8a50 and the four sibling stable commits). If patching must be deferred, the only meaningful compensating control is to reduce exposure of the Bluetooth attack surface: unload the Bluetooth stack or disable the adapter (rmmod/rfkill block bluetooth) on systems that do not need it, accepting the trade-off that all Bluetooth functionality is lost; restricting which controllers/devices are paired does not fully close the path because the bug is triggered by controller-sourced HCI events.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

EUVD-2025-201644 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy