Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2025-40318

Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF". Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • f00f36db76eb8fd10d13e80e2590f23b5beaa54d to < 0a94f7e017438935c09ef833a1aa908ad9875213affected
  • 1499f79995c7ee58e3bfeeff75f6d1b37dcda881 to < 932c0a4f77ac13e526fdd5b42914d29c9821d389affected
  • 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 to < ae76cf6c2c842944c6514c57df54d728f1916553affected
  • 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 to < 9cd536970192b72257afcdfba0bfc09993e6f19caffected
  • 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 to < 09b0cd1297b4dbfe736aeaa0ceeab2265f47f772affected
  • 357603f4d396d85fbf0045512efaf1d7f7394ed7affected
  • 6.1.120 to < 6.1.159affected
  • 6.6.51 to < 6.6.117affected
  • 6.8.9 to < 6.9affected

Linux Linux

Default version status: affected

  • 6.9affected
  • 0 to < 6.9unaffected
  • 6.1.159 to ≤ 6.1.*unaffected
  • 6.6.117 to ≤ 6.6.*unaffected
  • 6.12.58 to ≤ 6.12.*unaffected
  • 6.17.8 to ≤ 6.17.*unaffected
  • 6.18 to ≤ *unaffected

References