Kernel Panic Vulnerability in Linux Package: Bluetooth Firmware Release Issue
Summary
DEBIAN-CVE-2025-22102: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix kernel panic during FW release This fixes a kernel panic seen during release FW in a stress test scenario where WLAN and BT FW... Affects linux versions < 6.12.30-1. Fixed in 6.12.30-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionality for managing hardware and system resources. It is widely used in various environments, including servers, desktops, and embedded systems. The package supports a range of hardware interfaces, including Bluetooth, which is crucial for wireless communication. This vulnerability specifically affects the Bluetooth subsystem, where a flaw can lead to a kernel panic during firmware release under certain stress test conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Bluetooth subsystem, specifically in the btnxpuart driver. This issue arises when the firmware release process encounters a hardware bug that prevents the proper handling of bootloader signatures. When the driver receives only one bootloader signature instead of the expected consecutive signatures, it enters firmware download mode but fails to request the firmware file. After a timeout period of 60 seconds, the release_firmware function triggers a kernel panic, leading to system instability. This vulnerability can be exploited in scenarios where both WLAN and Bluetooth firmware downloads occur simultaneously, potentially causing significant disruptions in system operations.
How To Fix
Minimum fixed version
6.12.30-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid simultaneous firmware downloads for WLAN and Bluetooth to prevent triggering the kernel panic. This may involve scheduling firmware updates separately to ensure that the system does not encounter the conditions that lead to the vulnerability.
Conclusion
The identified vulnerability in the Linux package's Bluetooth subsystem poses a significant risk of kernel panic during firmware release under specific conditions. Users are strongly advised to update to the patched version to mitigate this risk. Implementing the suggested workaround can also help in managing the vulnerability until an update can be applied.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to a kernel panic, causing system crashes and potential data loss during critical operations.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, the vulnerability affects the Linux package in Debian 13 and Debian 14 prior to version 6.12.30-1.
If immediate updates are not possible, consider implementing the workaround of avoiding simultaneous firmware downloads for WLAN and Bluetooth.
Detailed information can be found in the Debian CVE database or by visiting the Vulert website for real-time vulnerability monitoring.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
