Bluetooth Suspend/Resume Stalls in Linux Kernel - linux Package Vulnerability
Summary
DEBIAN-CVE-2025-38507: In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: avoid bluetooth suspend/resume stalls Ensure we don't stall or panic the kernel when using bluetooth-connected controllers. Affects linux versions < 6.12.41-1. Fixed in 6.12.41-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources, hardware interactions, and process scheduling. This package is crucial for the stability and performance of the operating system, supporting a wide range of hardware and software functionalities. The vulnerability in question affects the handling of Bluetooth-connected controllers, particularly in scenarios involving suspend and resume operations, which can lead to kernel stalls or panics.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the HID (Human Interface Device) subsystem related to Nintendo controllers. This issue arises during the suspend and resume process of Bluetooth-connected controllers, where the kernel may stall or panic due to unreliable connectivity. The problem was initially reported on Android devices using kernel version 6.6, stemming from a resume hook added for USB Joy-Cons. The vulnerability can lead to system instability and unresponsive behavior when using Bluetooth controllers, especially if the connection is lost prior to suspend.
How To Fix
Minimum fixed version
6.12.41-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using Bluetooth-connected controllers during suspend/resume operations until the package is updated. Additionally, ensuring a stable connection before suspending the system may help mitigate the issue.
Conclusion
The vulnerability in the Linux kernel related to Bluetooth suspend/resume operations poses a risk of system instability when using Nintendo controllers. Users are advised to update their linux package to the latest patched versions to mitigate this issue. Until then, employing workarounds can help reduce the impact of the vulnerability.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves potential stalls or panics in the Linux kernel when using Bluetooth-connected Nintendo controllers during suspend and resume operations.
The vulnerability affects all versions prior to 6.12.41-1 for Debian 13 and 6.16.3-1 for Debian 14.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If an immediate update is not possible, avoid using Bluetooth controllers during suspend/resume operations as a temporary workaround.
Detailed information about this vulnerability can be found in the Debian CVE database or by visiting the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
