{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-39982",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-04-16T07:20:57.150Z",
        "datePublished": "2025-10-15T07:56:02.024Z",
        "dateUpdated": "2026-08-05T12:06:50.448Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:06:50.448Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync\n\nThis fixes the following UFA in hci_acl_create_conn_sync where a\nconnection still pending is command submission (conn->state == BT_OPEN)\nmaybe freed, also since this also can happen with the likes of\nhci_le_create_conn_sync fix it as well:\n\nBUG: KASAN: slab-use-after-free in hci_acl_create_conn_sync+0x5ef/0x790 net/bluetooth/hci_sync.c:6861\nWrite of size 2 at addr ffff88805ffcc038 by task kworker/u11:2/9541\n\nCPU: 1 UID: 0 PID: 9541 Comm: kworker/u11:2 Not tainted 6.16.0-rc7 #3 PREEMPT(full)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014\nWorkqueue: hci3 hci_cmd_sync_work\nCall Trace:\n <TASK>\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xca/0x230 mm/kasan/report.c:480\n kasan_report+0x118/0x150 mm/kasan/report.c:593\n hci_acl_create_conn_sync+0x5ef/0x790 net/bluetooth/hci_sync.c:6861\n hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332\n process_one_work kernel/workqueue.c:3238 [inline]\n process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402\n kthread+0x70e/0x8a0 kernel/kthread.c:464\n ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245\n </TASK>\n\nAllocated by task 123736:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359\n kmalloc_noprof include/linux/slab.h:905 [inline]\n kzalloc_noprof include/linux/slab.h:1039 [inline]\n __hci_conn_add+0x233/0x1b30 net/bluetooth/hci_conn.c:939\n hci_conn_add_unset net/bluetooth/hci_conn.c:1051 [inline]\n hci_connect_acl+0x16c/0x4e0 net/bluetooth/hci_conn.c:1634\n pair_device+0x418/0xa70 net/bluetooth/mgmt.c:3556\n hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719\n hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg+0x219/0x270 net/socket.c:727\n sock_write_iter+0x258/0x330 net/socket.c:1131\n new_sync_write fs/read_write.c:593 [inline]\n vfs_write+0x54b/0xa90 fs/read_write.c:686\n ksys_write+0x145/0x250 fs/read_write.c:738\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 103680:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576\n poison_slab_object mm/kasan/common.c:247 [inline]\n __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264\n kasan_slab_free include/linux/kasan.h:233 [inline]\n slab_free_hook mm/slub.c:2381 [inline]\n slab_free mm/slub.c:4643 [inline]\n kfree+0x18e/0x440 mm/slub.c:4842\n device_release+0x9c/0x1c0\n kobject_cleanup lib/kobject.c:689 [inline]\n kobject_release lib/kobject.c:720 [inline]\n kref_put include/linux/kref.h:65 [inline]\n kobject_put+0x22b/0x480 lib/kobject.c:737\n hci_conn_cleanup net/bluetooth/hci_conn.c:175 [inline]\n hci_conn_del+0x8ff/0xcb0 net/bluetooth/hci_conn.c:1173\n hci_conn_complete_evt+0x3c7/0x1040 net/bluetooth/hci_event.c:3199\n hci_event_func net/bluetooth/hci_event.c:7477 [inline]\n hci_event_packet+0x7e0/0x1200 net/bluetooth/hci_event.c:7531\n hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070\n process_one_work kernel/workqueue.c:3238 [inline]\n process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402\n kthread+0x70e/0x8a0 kernel/kthread.c:464\n ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 home/kwqcheii/sour\n---truncated---"
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 8.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:A - The freeing side of the race is driven by HCI Connection Complete / LE Connection Complete events that a nearby Bluetooth device causes the controller to generate by paging or connecting to the victim and then failing the link. This is Bluetooth radio range, i.e. an adjacent network attacker, not a remote internet attacker.\nAC:L - The attacker drives both halves — it chooses when to page/connect and when to abort so the error-status Connection Complete lands while the hci_conn is still BT_OPEN, and the window is very wide because hci_acl_create_conn_sync first blocks on an HCI_OP_INQUIRY_CANCEL round-trip while the freeing runs on a different workqueue with no shared lock. The attempt is freely repeatable until it wins.\nPR:N - The adjacent attacker needs no credentials or pairing on the target — hci_conn_request_evt accepts pages from a connectable/accept-listed device before any authentication, and the outgoing connection it collides with comes from BlueZ auto-reconnect or an unprivileged L2CAP connect() with no capability check.\nUI:N - No victim action is required; background auto-connect to a previously paired device or a listening L2CAP/RFCOMM service creates the pending BT_OPEN hci_conn automatically, and the attacker can induce it by advertising as a device on the victim's accept list.\nS:U - The corruption is confined to kernel slab memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - After the free the worker reads conn->pkt_type, conn->dst, and conn->conn_timeout out of the reclaimed slab object and emits them in an HCI Create Connection command, and the UAF permits heap grooming for controlled reads of adjacent kernel data.\nI:H - The worker writes into the freed object at fixed offsets — conn->state, conn->out, conn->role, an attempt counter, link_policy, a refcount increment via hci_conn_get(), and a 3-byte memcpy of the attacker's own Class-of-Device — giving a groomable write primitive into a reclaimed kmalloc slot suitable for control-flow hijack.\nA:H - The KASAN report shows a slab-use-after-free write from hci_cmd_sync_work, which reliably oopses or panics the kernel and can be re-triggered by the attacker at will."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "include/net/bluetooth/hci_core.h",
                        "net/bluetooth/hci_event.c"
                    ],
                    "versions": [
                        {
                            "version": "aef2aa4fa98e18ea5d9345bf777ee698c8598728",
                            "lessThan": "6243bda271a628c48875e3e473206e7f584892ce",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "aef2aa4fa98e18ea5d9345bf777ee698c8598728",
                            "lessThan": "bcce99f613163a43de24674b717e7a6c135fc879",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "aef2aa4fa98e18ea5d9345bf777ee698c8598728",
                            "lessThan": "484c7d571a3d1b3fd298fa691b660438c4548a53",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "aef2aa4fa98e18ea5d9345bf777ee698c8598728",
                            "lessThan": "a78fd4fc5694ecb3b97deb2ad9eaebd67b4d2b08",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "aef2aa4fa98e18ea5d9345bf777ee698c8598728",
                            "lessThan": "9e622804d57e2d08f0271200606bd1270f75126f",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "include/net/bluetooth/hci_core.h",
                        "net/bluetooth/hci_event.c"
                    ],
                    "versions": [
                        {
                            "version": "5.18",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "5.18",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1.155",
                            "lessThanOrEqual": "6.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.109",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.50",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.16.10",
                            "lessThanOrEqual": "6.16.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.17",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.18",
                                    "versionEndExcluding": "6.1.155"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.18",
                                    "versionEndExcluding": "6.6.109"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.18",
                                    "versionEndExcluding": "6.12.50"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.18",
                                    "versionEndExcluding": "6.16.10"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.18",
                                    "versionEndExcluding": "6.17"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/6243bda271a628c48875e3e473206e7f584892ce"
                },
                {
                    "url": "https://git.kernel.org/stable/c/bcce99f613163a43de24674b717e7a6c135fc879"
                },
                {
                    "url": "https://git.kernel.org/stable/c/484c7d571a3d1b3fd298fa691b660438c4548a53"
                },
                {
                    "url": "https://git.kernel.org/stable/c/a78fd4fc5694ecb3b97deb2ad9eaebd67b4d2b08"
                },
                {
                    "url": "https://git.kernel.org/stable/c/9e622804d57e2d08f0271200606bd1270f75126f"
                }
            ],
            "title": "Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}