Critical Bluetooth Management Vulnerability in Linux Kernel
Summary
CVE-2025-38117: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Protect mgmt_pending list with its own lock This uses a mutex to protect from concurrent access of mgmt_pending list which can cause cr... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux operating systems, managing system resources and hardware interactions. It provides essential services for all other software on the system. The kernel is known for its stability, performance, and security features. However, vulnerabilities can arise, such as the one identified in Bluetooth management, which can lead to severe system crashes and security risks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Bluetooth management subsystem. This issue arises from the lack of proper locking mechanisms for the mgmt_pending list, which can lead to concurrent access and potential crashes. Specifically, this vulnerability manifests as a 'slab-use-after-free' error, where memory that has already been freed is accessed, leading to unpredictable behavior and system instability. The vulnerability can be exploited by malicious actors to cause system crashes or potentially execute arbitrary code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit the use of Bluetooth functionalities until the kernel is updated. This can be done by disabling Bluetooth services using the command:
sudo systemctl stop bluetooth.service'.
Conclusion
The CVE-2025-38117 vulnerability in the Linux kernel's Bluetooth management subsystem poses significant risks, including system crashes and potential exploitation. Users are strongly advised to update their systems to the latest patched version to ensure security and stability. Temporary workarounds are available, but they do not replace the need for a proper update.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38117 is a vulnerability in the Linux kernel's Bluetooth management subsystem that can lead to system crashes due to improper handling of memory.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The risks include system crashes and potential exploitation by attackers to execute arbitrary code, leading to unauthorized access or data loss.
Yes, a patch has been released. Users should update their Linux kernel to the latest version that includes the fix for CVE-2025-38117.
If immediate updates are not possible, consider disabling Bluetooth services as a temporary workaround to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
