PT-2025-42258 · Linux+1 · Linux Kernel+1

Published 2025-09-20 · Updated 2025-12-08 · CVE-2025-39983

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.16-rc7

Description The Linux kernel contains a use-after-free flaw within the Bluetooth stack, specifically in the hci conn tx dequeue function. This issue arises from improper locking of the hdev structure when processing HCI EV NUM COMP PKTS events, leading to a potential use-after-free condition. The vulnerability was identified through KASAN (Kernel Address Sanitizer) testing and is triggered during the handling of Bluetooth events.

Recommendations Update to a version newer than 6.16-rc7.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2025:22854

BDU:2026-03910

CVE-2025-39983

INFSA-2025_21469

RHSA-2025_21469

RHSA-2026:0271

RHSA-2026:0457

Affected Products

Linux Kernel

Red Hat

References · 40

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39983.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-39983 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-39983 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03910 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-39983 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-21469.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-39983 · Security Note
• https://errata.almalinux.org/10/ALSA-2025-22854.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:22854 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-39983 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-39983 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-39983 · Security Note
• https://bugzilla.redhat.com/2404105 · Note
• https://bugzilla.redhat.com/2406758 · Note
• https://twitter.com/CVEnew/status/1978562065456349432 · Twitter Post