Critical Use-After-Free Vulnerability in Linux Kernel Bluetooth Module
Summary
CVE-2025-38250: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot reported use-after-free in vhci_flush() without repro. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, including device drivers, system calls, and process management. The Bluetooth module within the kernel facilitates wireless communication between devices. This vulnerability specifically affects the Bluetooth subsystem, where improper handling of device references can lead to serious security issues.
Vulnerability Detail
In the Linux kernel, a use-after-free vulnerability has been identified in the Bluetooth subsystem, specifically in the vhci_flush() function. This issue arises when a thread closes a vhci file descriptor while another thread is using the device, leading to potential access to freed memory. The lack of synchronization after unlinking the device from the device list can result in data races, causing crashes or arbitrary code execution. The vulnerability was reported by syzbot, highlighting the need for immediate attention to prevent exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid closing vhci file descriptors while they are in use by other threads. This can be managed by implementing proper synchronization mechanisms in the application code that interacts with the Bluetooth subsystem.
Conclusion
The identified use-after-free vulnerability in the Linux kernel's Bluetooth module poses significant risks to system security. Users are strongly advised to update their systems to the latest patched versions to mitigate these risks. Implementing proper synchronization in applications can also help reduce the likelihood of exploitation.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to crashes or arbitrary code execution.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The impacts can range from system crashes to unauthorized access and control over the affected device, leading to severe security risks.
Yes, patches are available for Debian 11, 12, and 13. Users should update their Linux kernel to the latest version to mitigate the risk.
If immediate updates are not possible, ensure that you avoid using the affected Bluetooth functionalities until a patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
