CVE-2025-40318
Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF". Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.
| Vendor | linux |
| Product | linux |
| Ecosystems | |
| Industries | Technology |
| Published | Dec 8, 2025 |
| Last Updated | May 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for linux linux
Be the first to know when new unknown vulnerabilities affecting linux linux are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Linux / Linux
f00f36db76eb8fd10d13e80e2590f23b5beaa54d < 0a94f7e017438935c09ef833a1aa908ad9875213 1499f79995c7ee58e3bfeeff75f6d1b37dcda881 < 932c0a4f77ac13e526fdd5b42914d29c9821d389 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 < ae76cf6c2c842944c6514c57df54d728f1916553 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 < 9cd536970192b72257afcdfba0bfc09993e6f19c 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 < 09b0cd1297b4dbfe736aeaa0ceeab2265f47f772 357603f4d396d85fbf0045512efaf1d7f7394ed7
Linux / Linux
6.9
References
git.kernel.org: https://git.kernel.org/stable/c/0a94f7e017438935c09ef833a1aa908ad9875213 git.kernel.org: https://git.kernel.org/stable/c/932c0a4f77ac13e526fdd5b42914d29c9821d389 git.kernel.org: https://git.kernel.org/stable/c/ae76cf6c2c842944c6514c57df54d728f1916553 git.kernel.org: https://git.kernel.org/stable/c/9cd536970192b72257afcdfba0bfc09993e6f19c git.kernel.org: https://git.kernel.org/stable/c/09b0cd1297b4dbfe736aeaa0ceeab2265f47f772