CVE-2025-40141 — Expired Pointer Dereference in Linux

CWE-825 — Expired Pointer Dereference32 documents6 sources
Severity
3.2LOWOSV
No vector
EPSS
0.0%
top 94.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
LinuxLinux KernelDebian Linux+1 more
Timeline
PublishedNov 12
Latest updateApr 9

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix possible UAF on iso_conn_free This attempt to fix similar issue to sco_conn_free where if the conn->sk is not set to NULL may lead to UAF on iso_conn_free.

Affected Packages6 packages

▶Linuxlinux/linux_kernel6.0.0 — 6.1.156+3
▶Debianlinux/linux_kernel< 6.1.158-1+2
▶Ubuntulinux/linux_kernel< 6.8.0-106.106+1
▶CVEListV5linux/linuxccf74f2390d60a2f9a75ef496d2564abb478f46a — eba6d787ec117a5d2c60f9644e0a39c18542b6be+5
▶debiandebian/linux< linux 6.1.158-1 (bookworm)

🔴Vulnerability Details

16
OSV
linux-raspi, linux-raspi-realtime vulnerabilities↗2026-04-01
▶
OSV
linux-azure-6.8 vulnerabilities↗2026-03-25
▶
OSV
linux-azure vulnerabilities↗2026-03-25
▶
OSV
linux-aws-6.8 vulnerabilities↗2026-03-23
▶
OSV
linux-realtime, linux-realtime-6.8 vulnerabilities↗2026-03-17
▶

📋Vendor Advisories

15
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities↗2026-04-09
▶
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities↗2026-04-01
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2026-03-25
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2026-03-25
▶
Ubuntu
Linux kernel (AWS) vulnerabilities↗2026-03-23
▶