Race Condition Vulnerability in Linux Kernel Bluetooth hci_uart Package
Summary
CVE-2025-23139: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Affects linux versions < 6.1.135-1. Fixed in 6.1.135-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services and hardware management. The Bluetooth subsystem, specifically the hci_uart driver, facilitates communication between Bluetooth devices and the host system. This driver is crucial for enabling Bluetooth functionality in various applications, making it a vital part of the kernel's networking capabilities.
Vulnerability Detail
In the Linux kernel, a race condition vulnerability exists within the Bluetooth hci_uart driver. This issue arises when the 'HCI_UART_PROTO_READY' flag is set before the device is registered with 'hci_uart_register_dev()'. If 'hci_tty_uart_close()' is called after this flag is set but before the device registration is complete, it can lead to access to uninitialized fields, potentially causing system crashes or unpredictable behavior. The vulnerability was identified through a crash backtrace from a syzbot report, indicating the need for immediate attention to prevent exploitation.
How To Fix
Minimum fixed version
6.1.135-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid triggering the race condition by ensuring that the Bluetooth device is not accessed or closed while the initialization process is ongoing. However, this is not a permanent solution and updating the kernel is strongly recommended.
Conclusion
The race condition vulnerability in the Linux kernel's Bluetooth hci_uart driver poses significant risks, including system crashes and unpredictable behavior. Users are advised to update to the patched version 6.1.135-1 to mitigate these risks. Temporary workarounds exist, but they are not substitutes for a proper update.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes or unpredictable behavior due to access to uninitialized fields in the Bluetooth driver.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, ensure that Bluetooth devices are not accessed during the initialization phase as a temporary workaround.
Yes, the vulnerability affects versions prior to the patched version 6.1.135-1 in the Debian ecosystem.
Vulert monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights into potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
