cbcvebase.
CVE-2025-38250
published 2025-07-09

CVE-2025-38250: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot reported use-after-free in…

PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
4.2th percentile
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot reported use-after-free in vhci_flush() without repro. [0] From the splat, a thread close()d a vhci file descriptor while its device was being used by iotcl() on another thread. Once the last fd refcnt is released, vhci_release() calls hci_unregister_dev(), hci_free_dev(), and kfree() for struct vhci_data, which is set to hci_dev->dev->driver_data. The problem is that there is no synchronisation after unlinking hdev from hci_dev_list in hci_unregister_dev(). There might be another thread still accessing the hdev which was fetched before the unlink operation. We can use SRCU for such synchronisation. Let's run hci_dev_reset() under SRCU and wait for its completion in hci_unregister_dev(). Another option would be to restore hci_dev->destruct(), which was removed in commit 587ae086f6e4 ("Bluetooth: Remove unused hci-destruct cb"). However, this would not be a good solution, as we should not run hci_unregister_dev() while there are in-flight ioctl() requests, which could lead to another data-race KCSAN splat. Note that other drivers seem to have the same problem, for exmaple, virtbt_remove(). [0]: BUG: KASAN: slab-use-after-free in skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline] BUG: KASAN: slab-use-after-free in skb_queue_purge_reason+0x99/0x360 net/core/skbuff.c:3937 Read of size 8 at addr ffff88807cb8d858 by task syz.1.219/6718 CPU: 1 UID: 0 PID: 6718 Comm: syz.1.219 Not tainted 6.16.0-rc1-syzkaller-00196-g08207f42d3ff #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xd2/0x2b0 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline] skb_queue_purge_reason

Affected

52 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.12.37-1 (forky)linux 6.12.37-1 (forky)
linuxlinux
linuxlinux>= bf18c7118cf83ad4b9aa476354b4a06bcb9d0c4f < dd4becd3fd4102696e1c15e6d260a1712a2d8685dd4becd3fd4102696e1c15e6d260a1712a2d8685
linuxlinux>= bf18c7118cf83ad4b9aa476354b4a06bcb9d0c4f < 90dee0a0ff84fac8accd5be98412b3819f66714990dee0a0ff84fac8accd5be98412b3819f667149
linuxlinux>= bf18c7118cf83ad4b9aa476354b4a06bcb9d0c4f < c56b177efce8b62798e4d96bdb9867106cb7c4a0c56b177efce8b62798e4d96bdb9867106cb7c4a0
linuxlinux>= bf18c7118cf83ad4b9aa476354b4a06bcb9d0c4f < bc0819a25e04cd68ef3568cfa51b63118fea39a7bc0819a25e04cd68ef3568cfa51b63118fea39a7
linuxlinux>= bf18c7118cf83ad4b9aa476354b4a06bcb9d0c4f < ce23b73f0f27e2dbeb81734a79db710f05aa33c6ce23b73f0f27e2dbeb81734a79db710f05aa33c6
linuxlinux>= bf18c7118cf83ad4b9aa476354b4a06bcb9d0c4f < 0e5c144c557df910ab64d9c25d06399a9a735e650e5c144c557df910ab64d9c25d06399a9a735e65
linuxlinux>= bf18c7118cf83ad4b9aa476354b4a06bcb9d0c4f < 1d6123102e9fbedc8d25bf4731da6d513173e49e1d6123102e9fbedc8d25bf4731da6d513173e49e
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.12.37-16.12.37-1
linuxlinux_kernel>= 0 < 6.12.37-16.12.37-1
linuxlinux_kernel>= 0 < 6.8.0-100.1006.8.0-100.100
linuxlinux_kernel>= 3.4 < 6.6.976.6.97
linuxlinux_kernel>= 6.13 < 6.15.56.15.5
linuxlinux_kernel>= 6.7 < 6.12.366.12.36
msrcazl3_kernel_6.6.96.2-1_on_azure_linux_3.0
msrcazl3_kernel_6.6.96.2-2_on_azure_linux_3.0
msrccbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0
msrccbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0
msrccbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0
ubuntulinux
ubuntulinux-aws

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.1HIGH
vendor_msrc6.0MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.