{"id":"CVE-2025-38473","state":"PUBLISHED","title":"Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()\n\nsyzbot reported null-ptr-deref in l2cap_sock_resume_cb(). [0]\n\nl2cap_sock_resume_cb() has a similar problem that was fixed by commit\n1bff51ea59a9 (\"Bluetooth: fix use-after-free error in lock_sock_nested()\").\n\nSince both l2cap_sock_kill() and l2cap_sock_resume_cb() are executed\nunder l2cap_sock_resume_cb(), we can avoid the issue simply by checking\nif chan->data is NULL.\n\nLet's not access to the killed socket in l2cap_sock_resume_cb().\n\n[0]:\nBUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:82 [inline]\nBUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]\nBUG: KASAN: null-ptr-deref in l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711\nWrite of size 8 at addr 0000000000000570 by task kworker/u9:0/52\n\nCPU: 1 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\nWorkqueue: hci0 hci_rx_work\nCall trace:\n show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:501 (C)\n __dump_stack+0x30/0x40 lib/dump_stack.c:94\n dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120\n print_report+0x58/0x84 mm/kasan/report.c:524\n kasan_report+0xb0/0x110 mm/kasan/report.c:634\n check_region_inline mm/kasan/generic.c:-1 [inline]\n kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189\n __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37\n instrument_atomic_write include/linux/instrumented.h:82 [inline]\n clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]\n l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711\n l2cap_security_cfm+0x524/0xea0 net/bluetooth/l2cap_core.c:7357\n hci_auth_cfm include/net/bluetooth/hci_core.h:2092 [inline]\n hci_auth_complete_evt+0x2e8/0xa4c net/bluetooth/hci_event.c:3514\n hci_event_func net/bluetooth/hci_event.c:7511 [inline]\n hci_event_packet+0x650/0xe9c net/bluetooth/hci_event.c:7565\n hci_rx_work+0x320/0xb18 net/bluetooth/hci_core.c:4070\n process_one_work+0x7e8/0x155c kernel/workqueue.c:3238\n process_scheduled_works kernel/workqueue.c:3321 [inline]\n worker_thread+0x958/0xed8 kernel/workqueue.c:3402\n kthread+0x5fc/0x75c kernel/kthread.c:464\n ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847","publishedAt":"2025-07-28T11:21:34.880Z","updatedAt":"2026-05-11T21:28:41.562Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"262cd18f5f7ede6a586580cadc5d0799e52e2e7c","versionType":"git"},{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"2b27b389006623673e8cfff4ce1e119cce640b05","versionType":"git"},{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"3a4eca2a1859955c65f07a570156bd2d9048ce33","versionType":"git"},{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"ac3a8147bb24314fb3e84986590148e79f9872ec","versionType":"git"},{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"c4f16f6b071a74ac7eefe5c28985285cbbe2cd96","versionType":"git"},{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"b97be7ee8a1cd96b89817cbd64a9f5cc16c17d08","versionType":"git"},{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"6d63901dcd592a1e3f71d7c6d78f9be5e8d7eef0","versionType":"git"},{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"a0075accbf0d76c2dad1ad3993d2e944505d99a0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/l2cap_sock.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.13","versionType":"semver"},{"version":"5.4.297","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.241","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.190","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.147","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.100","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.40","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.8","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/l2cap_sock.c"]}],"references":["https://git.kernel.org/stable/c/262cd18f5f7ede6a586580cadc5d0799e52e2e7c","https://git.kernel.org/stable/c/2b27b389006623673e8cfff4ce1e119cce640b05","https://git.kernel.org/stable/c/3a4eca2a1859955c65f07a570156bd2d9048ce33","https://git.kernel.org/stable/c/ac3a8147bb24314fb3e84986590148e79f9872ec","https://git.kernel.org/stable/c/c4f16f6b071a74ac7eefe5c28985285cbbe2cd96","https://git.kernel.org/stable/c/b97be7ee8a1cd96b89817cbd64a9f5cc16c17d08","https://git.kernel.org/stable/c/6d63901dcd592a1e3f71d7c6d78f9be5e8d7eef0","https://git.kernel.org/stable/c/a0075accbf0d76c2dad1ad3993d2e944505d99a0","https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/38xxx/CVE-2025-38473.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38473","state":"PUBLISHED","datePublished":"2025-07-28T11:21:34.880Z","dateUpdated":"2026-05-11T21:28:41.562Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T04:51:24.021Z"},"containers":{"cna":{"title":"Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()\n\nsyzbot reported null-ptr-deref in l2cap_sock_resume_cb(). [0]\n\nl2cap_sock_resume_cb() has a similar problem that was fixed by commit\n1bff51ea59a9 (\"Bluetooth: fix use-after-free error in lock_sock_nested()\").\n\nSince both l2cap_sock_kill() and l2cap_sock_resume_cb() are executed\nunder l2cap_sock_resume_cb(), we can avoid the issue simply by checking\nif chan->data is NULL.\n\nLet's not access to the killed socket in l2cap_sock_resume_cb().\n\n[0]:\nBUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:82 [inline]\nBUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]\nBUG: KASAN: null-ptr-deref in l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711\nWrite of size 8 at addr 0000000000000570 by task kworker/u9:0/52\n\nCPU: 1 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\nWorkqueue: hci0 hci_rx_work\nCall trace:\n show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:501 (C)\n __dump_stack+0x30/0x40 lib/dump_stack.c:94\n dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120\n print_report+0x58/0x84 mm/kasan/report.c:524\n kasan_report+0xb0/0x110 mm/kasan/report.c:634\n check_region_inline mm/kasan/generic.c:-1 [inline]\n kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189\n __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37\n instrument_atomic_write include/linux/instrumented.h:82 [inline]\n clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]\n l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711\n l2cap_security_cfm+0x524/0xea0 net/bluetooth/l2cap_core.c:7357\n hci_auth_cfm include/net/bluetooth/hci_core.h:2092 [inline]\n hci_auth_complete_evt+0x2e8/0xa4c net/bluetooth/hci_event.c:3514\n hci_event_func net/bluetooth/hci_event.c:7511 [inline]\n hci_event_packet+0x650/0xe9c net/bluetooth/hci_event.c:7565\n hci_rx_work+0x320/0xb18 net/bluetooth/hci_core.c:4070\n process_one_work+0x7e8/0x155c kernel/workqueue.c:3238\n process_scheduled_works kernel/workqueue.c:3321 [inline]\n worker_thread+0x958/0xed8 kernel/workqueue.c:3402\n kthread+0x5fc/0x75c kernel/kthread.c:464\n ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"262cd18f5f7ede6a586580cadc5d0799e52e2e7c","versionType":"git"},{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"2b27b389006623673e8cfff4ce1e119cce640b05","versionType":"git"},{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"3a4eca2a1859955c65f07a570156bd2d9048ce33","versionType":"git"},{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"ac3a8147bb24314fb3e84986590148e79f9872ec","versionType":"git"},{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"c4f16f6b071a74ac7eefe5c28985285cbbe2cd96","versionType":"git"},{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"b97be7ee8a1cd96b89817cbd64a9f5cc16c17d08","versionType":"git"},{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"6d63901dcd592a1e3f71d7c6d78f9be5e8d7eef0","versionType":"git"},{"version":"d97c899bde330cd1c76c3a162558177563a74362","status":"affected","lessThan":"a0075accbf0d76c2dad1ad3993d2e944505d99a0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/l2cap_sock.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.13","versionType":"semver"},{"version":"5.4.297","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.241","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.190","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.147","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.100","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.40","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.8","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/l2cap_sock.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/262cd18f5f7ede6a586580cadc5d0799e52e2e7c"},{"url":"https://git.kernel.org/stable/c/2b27b389006623673e8cfff4ce1e119cce640b05"},{"url":"https://git.kernel.org/stable/c/3a4eca2a1859955c65f07a570156bd2d9048ce33"},{"url":"https://git.kernel.org/stable/c/ac3a8147bb24314fb3e84986590148e79f9872ec"},{"url":"https://git.kernel.org/stable/c/c4f16f6b071a74ac7eefe5c28985285cbbe2cd96"},{"url":"https://git.kernel.org/stable/c/b97be7ee8a1cd96b89817cbd64a9f5cc16c17d08"},{"url":"https://git.kernel.org/stable/c/6d63901dcd592a1e3f71d7c6d78f9be5e8d7eef0"},{"url":"https://git.kernel.org/stable/c/a0075accbf0d76c2dad1ad3993d2e944505d99a0"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T21:28:41.562Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"5.4.297"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"5.10.241"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"5.15.190"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"6.1.147"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"6.6.100"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"6.12.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"6.15.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"6.16"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T17:38:39.105Z"}}]}}}