Critical Bluetooth Management Vulnerability in Linux Packages
Summary
CVE-2025-21936: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected() Add check for the return value of mgmt_alloc_skb() in mgmt_device_connected() to pr... Affects linux versions < 6.1.133-1. Fixed in 6.1.133-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services and functionalities for hardware and software interaction. It is widely used in various distributions, including Debian 12 and 13. This vulnerability affects the Bluetooth management subsystem, which is responsible for handling Bluetooth device connections and communications. The issue arises from a lack of proper error handling in the mgmt_device_connected() function, potentially leading to system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Bluetooth management subsystem. Specifically, the function mgmt_device_connected() does not adequately check the return value of mgmt_alloc_skb(), which can lead to a null pointer dereference. This oversight can cause the system to crash or behave unpredictably when attempting to connect Bluetooth devices, posing a significant risk to system stability and security.
How To Fix
Minimum fixed version
6.1.133-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The vulnerability CVE-2025-21936 in the Linux kernel's Bluetooth management subsystem poses a significant risk to system stability due to a null pointer dereference. Users are encouraged to update their packages to the patched version as soon as it becomes available to ensure their systems remain secure.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21936 is a vulnerability in the Linux kernel's Bluetooth management subsystem that can lead to a null pointer dereference.
This vulnerability can cause system crashes or unpredictable behavior when connecting Bluetooth devices, impacting system stability.
Debian 12 and 13 are affected by this vulnerability. Users should check their specific version and apply updates accordingly.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signing up.
While there are no specific workarounds, it is crucial to monitor for updates and apply them as soon as they are available to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
