Bluetooth Management Vulnerability in Linux Kernel: CVE-2025-38117
Summary
DEBIAN-CVE-2025-38117: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Protect mgmt_pending list with its own lock This uses a mutex to protect from concurrent access of mgmt_pending list which can cause cr... Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and device control. The kernel is crucial for system stability and performance. This specific vulnerability affects the Bluetooth subsystem, which facilitates wireless communication between devices. The issue arises from inadequate protection of the management pending list, leading to potential crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Bluetooth subsystem, specifically related to the management pending list. This vulnerability allows for concurrent access without proper synchronization, potentially leading to a use-after-free condition. The issue can cause crashes, as evidenced by the KASAN (Kernel Address Sanitizer) report indicating a slab-use-after-free error. The vulnerability is critical as it can be exploited by attackers to disrupt system stability or execute arbitrary code, posing a significant risk to users relying on Bluetooth functionalities.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risks associated with this issue.
Conclusion
The vulnerability CVE-2025-38117 in the Linux kernel's Bluetooth subsystem poses significant risks, including system crashes and potential exploitation. Users are urged to update their systems to the patched version to ensure security and stability. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38117 is a vulnerability in the Linux kernel's Bluetooth subsystem that can lead to crashes due to improper management of the pending list.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
The risks include potential system crashes and the possibility of arbitrary code execution, which can compromise system security.
Yes, a patch is available in the form of the Linux kernel version 6.12.35-1 for Debian 13 and 14.
You can update your Linux kernel by running the command: sudo apt-get update && sudo apt-get install linux=6.12.35-1 in your terminal.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
