PT-2025-49447 · Linux+4 · Linux Kernel+4
Published
2025-12-08
·
Updated
2026-05-07
·
CVE-2025-40318
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A race condition exists within the Bluetooth implementation in the Linux kernel, specifically in the
hci cmd sync dequeue once() function. This function performs a lookup and cancellation of an entry in two separate lock sections. Simultaneously, the hci cmd sync work() function can also delete the same entry, potentially leading to a double list del() operation and a Use-After-Free (UAF) condition. The issue is addressed by holding the cmd sync work lock across both the lookup and cancellation phases, preventing concurrent removal of the entry.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Rocky Linux
Ubuntu