CVE-2025-39860 (GCVE-0-2025-39860)

Vulnerability from cvelistv5 – Published: 2025-09-19 15:26 – Updated: 2026-08-05 12:05
VLAI
Title
Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the "Freed by task" part. Let's call l2cap_sock_cleanup_listen() under lock_sock() in l2cap_sock_release(). [0]: BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995 CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 spin_lock_bh include/linux/spinlock.h:356 [inline] release_sock+0x21/0x220 net/core/sock.c:3746 bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2accf8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f R10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490 </TASK> Allocated by task 5326: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4365 [inline] __kmalloc_nopro ---truncated---
Severity
8 (High)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: a2da00d1ea1abfb04f846638e210b5b5166e3c9c , < 964cbb198f9c46c2b2358cd1faffc04c1e8248cf (git)
Affected: 06f87c96216bc5cd1094c23492274f77f1d5dd3b , < 83e1d9892ef51785cf0760b7681436760dda435a (git)
Affected: fbe5a2fed8156cc19eb3b956602b0a1dd46a302d , < 47f6090bcf75c369695d21c3f179db8a56bbbd49 (git)
Affected: 29fac18499332211b2615ade356e2bd8b3269f98 , < 2ca99fc3512a8074de20ee52a87b492dfcc41a4d (git)
Affected: 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 , < 6077d16b5c0f65d571eee709de2f0541fb5ef0ca (git)
Affected: 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 , < 306b0991413b482dbf5585b423022123bb505966 (git)
Affected: 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 , < 3dff390f55ccd9ce12e91233849769b5312180c2 (git)
Affected: 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 , < 862c628108562d8c7a516a900034823b381d3cba (git)
Affected: 51822644a047eac2310fab0799b64e3430b5a111 (git)
Affected: 82cdb2ccbe43337798393369f0ceb98699fe6037 (git)
Affected: 10426afe65c8bf7b24dd0c7be4dcc65f86fc99f9 (git)
Affected: 5.4.253 , < 5.4.299 (semver)
Affected: 5.10.190 , < 5.10.243 (semver)
Affected: 5.15.126 , < 5.15.192 (semver)
Affected: 6.1.45 , < 6.1.151 (semver)
Affected: 4.14.322 , < 4.15 (semver)
Affected: 4.19.291 , < 4.20 (semver)
Affected: 6.4.10 , < 6.5 (semver)
Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 5.4.299 , ≤ 5.4.* (semver)
Unaffected: 5.10.243 , ≤ 5.10.* (semver)
Unaffected: 5.15.192 , ≤ 5.15.* (semver)
Unaffected: 6.1.151 , ≤ 6.1.* (semver)
Unaffected: 6.6.105 , ≤ 6.6.* (semver)
Unaffected: 6.12.46 , ≤ 6.12.* (semver)
Unaffected: 6.16.6 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens RUGGEDCOM RST2428P Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XCH328 Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XCM324 Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XCM328 Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XCM332 Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (230 V AC, 12xFO) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (230 V AC, 8xFO) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (24 V DC, 12xFO) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (24 V DC, 8xFO) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) Affected: 0 , < V3.3 (custom)
Create a notification for this product.
Siemens SIMATIC CN 4100 Affected: 0 , < V5.0 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:12.606Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCH328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM324",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM332",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:07:42.165Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "964cbb198f9c46c2b2358cd1faffc04c1e8248cf",
              "status": "affected",
              "version": "a2da00d1ea1abfb04f846638e210b5b5166e3c9c",
              "versionType": "git"
            },
            {
              "lessThan": "83e1d9892ef51785cf0760b7681436760dda435a",
              "status": "affected",
              "version": "06f87c96216bc5cd1094c23492274f77f1d5dd3b",
              "versionType": "git"
            },
            {
              "lessThan": "47f6090bcf75c369695d21c3f179db8a56bbbd49",
              "status": "affected",
              "version": "fbe5a2fed8156cc19eb3b956602b0a1dd46a302d",
              "versionType": "git"
            },
            {
              "lessThan": "2ca99fc3512a8074de20ee52a87b492dfcc41a4d",
              "status": "affected",
              "version": "29fac18499332211b2615ade356e2bd8b3269f98",
              "versionType": "git"
            },
            {
              "lessThan": "6077d16b5c0f65d571eee709de2f0541fb5ef0ca",
              "status": "affected",
              "version": "1728137b33c00d5a2b5110ed7aafb42e7c32e4a1",
              "versionType": "git"
            },
            {
              "lessThan": "306b0991413b482dbf5585b423022123bb505966",
              "status": "affected",
              "version": "1728137b33c00d5a2b5110ed7aafb42e7c32e4a1",
              "versionType": "git"
            },
            {
              "lessThan": "3dff390f55ccd9ce12e91233849769b5312180c2",
              "status": "affected",
              "version": "1728137b33c00d5a2b5110ed7aafb42e7c32e4a1",
              "versionType": "git"
            },
            {
              "lessThan": "862c628108562d8c7a516a900034823b381d3cba",
              "status": "affected",
              "version": "1728137b33c00d5a2b5110ed7aafb42e7c32e4a1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "51822644a047eac2310fab0799b64e3430b5a111",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "82cdb2ccbe43337798393369f0ceb98699fe6037",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "10426afe65c8bf7b24dd0c7be4dcc65f86fc99f9",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.299",
              "status": "affected",
              "version": "5.4.253",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.243",
              "status": "affected",
              "version": "5.10.190",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.192",
              "status": "affected",
              "version": "5.15.126",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.151",
              "status": "affected",
              "version": "6.1.45",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.322",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.291",
              "versionType": "semver"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.299",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.243",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.192",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.299",
                  "versionStartIncluding": "5.4.253",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.243",
                  "versionStartIncluding": "5.10.190",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.192",
                  "versionStartIncluding": "5.15.126",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.151",
                  "versionStartIncluding": "6.1.45",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.105",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.6",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.322",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.291",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()\n\nsyzbot reported the splat below without a repro.\n\nIn the splat, a single thread calling bt_accept_dequeue() freed sk\nand touched it after that.\n\nThe root cause would be the racy l2cap_sock_cleanup_listen() call\nadded by the cited commit.\n\nbt_accept_dequeue() is called under lock_sock() except for\nl2cap_sock_release().\n\nTwo threads could see the same socket during the list iteration\nin bt_accept_dequeue():\n\n  CPU1                        CPU2 (close())\n  ----                        ----\n  sock_hold(sk)               sock_hold(sk);\n  lock_sock(sk)   \u003c-- block close()\n  sock_put(sk)\n  bt_accept_unlink(sk)\n    sock_put(sk)  \u003c-- refcnt by bt_accept_enqueue()\n  release_sock(sk)\n                              lock_sock(sk)\n                              sock_put(sk)\n                              bt_accept_unlink(sk)\n                                sock_put(sk)        \u003c-- last refcnt\n                              bt_accept_unlink(sk)  \u003c-- UAF\n\nDepending on the timing, the other thread could show up in the\n\"Freed by task\" part.\n\nLet\u0027s call l2cap_sock_cleanup_listen() under lock_sock() in\nl2cap_sock_release().\n\n[0]:\nBUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]\nBUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115\nRead of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995\nCPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xcd/0x630 mm/kasan/report.c:482\n kasan_report+0xe0/0x110 mm/kasan/report.c:595\n debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]\n do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115\n spin_lock_bh include/linux/spinlock.h:356 [inline]\n release_sock+0x21/0x220 net/core/sock.c:3746\n bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312\n l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451\n l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425\n __sock_release+0xb3/0x270 net/socket.c:649\n sock_close+0x1c/0x30 net/socket.c:1439\n __fput+0x3ff/0xb70 fs/file_table.c:468\n task_work_run+0x14d/0x240 kernel/task_work.c:227\n resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]\n exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43\n exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]\n syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]\n syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]\n do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f2accf8ebe9\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4\nRAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9\nRDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003\nRBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f\nR10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c\nR13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490\n \u003c/TASK\u003e\n\nAllocated by task 5326:\n kasan_save_stack+0x33/0x60 mm/kasan/common.c:47\n kasan_save_track+0x14/0x30 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:388 [inline]\n __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __do_kmalloc_node mm/slub.c:4365 [inline]\n __kmalloc_nopro\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerability lives in the Bluetooth L2CAP socket layer, and the objects that get freed and reused are child sockets that only ever exist because an adjacent Bluetooth peer established L2CAP connections to the listening PSM (`l2cap_connect_cfm` \u2192 `l2cap_sock_new_connection_cb`). The attack surface therefore spans the Bluetooth piconet/radio range.\nAC:L - The attacker controls both sides of the race \u2014 one thread blocked in `accept()` on the listening L2CAP socket and another calling `close()` on the same fd \u2014 and can retry indefinitely while keeping many pending children queued to widen the `bt_accept_dequeue()` iteration window. Nothing about the race depends on conditions outside the attacker\u0027s influence.\nPR:L - `l2cap_sock_create()` requires no capability for `SOCK_SEQPACKET`/`SOCK_STREAM` (only `SOCK_RAW` gates on `CAP_NET_RAW`), and binding a dynamic PSM \u2265 0x1001 bypasses the `CAP_NET_BIND_SERVICE` check, so an ordinary unprivileged local user can create, listen on, accept from and close the socket that triggers the race.\nUI:N - The race is driven entirely by the attacker\u0027s own threads performing `accept()` and `close()` syscalls plus inbound L2CAP connections; no victim action is needed.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The freed `struct sock` is read after free (`debug_spin_lock_before`/`release_sock`) and lives in a general kmalloc cache, so an attacker who sprays replacement objects into the freed slot can read back attacker-chosen or sensitive kernel data through the stale socket, giving an arbitrary-read path.\nI:H - After the free the kernel still writes into the object \u2014 `list_del_init()` on the freed `accept_q` node (an unlink write of attacker-groomable pointers), `sk_acceptq_removed()`, a refcount decrement, and spinlock stores \u2014 yielding a write primitive into reclaimed heap memory that is exploitable for control-flow hijack and privilege escalation.\nA:H - The bug is a confirmed slab use-after-free (syzbot KASAN splat) that corrupts the parent\u0027s accept queue list and takes a spinlock on freed memory, reliably producing an oops/panic and unbootable-level kernel instability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:41.301Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/964cbb198f9c46c2b2358cd1faffc04c1e8248cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/83e1d9892ef51785cf0760b7681436760dda435a"
        },
        {
          "url": "https://git.kernel.org/stable/c/47f6090bcf75c369695d21c3f179db8a56bbbd49"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ca99fc3512a8074de20ee52a87b492dfcc41a4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6077d16b5c0f65d571eee709de2f0541fb5ef0ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/306b0991413b482dbf5585b423022123bb505966"
        },
        {
          "url": "https://git.kernel.org/stable/c/3dff390f55ccd9ce12e91233849769b5312180c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/862c628108562d8c7a516a900034823b381d3cba"
        }
      ],
      "title": "Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39860",
    "datePublished": "2025-09-19T15:26:30.767Z",
    "dateReserved": "2025-04-16T07:20:57.143Z",
    "dateUpdated": "2026-08-05T12:05:41.301Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39860",
      "date": "2026-08-05",
      "epss": "0.00211",
      "percentile": "0.1142"
    },
    "microsoft_vex": {
      "current_release_date": "2025-09-21T01:02:36.000Z",
      "cve": "CVE-2025-39860",
      "id": "msrc_CVE-2025-39860",
      "initial_release_date": "2025-09-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39860.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39860\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-19T16:15:44.973\",\"lastModified\":\"2026-07-30T06:23:51.477\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()\\n\\nsyzbot reported the splat below without a repro.\\n\\nIn the splat, a single thread calling bt_accept_dequeue() freed sk\\nand touched it after that.\\n\\nThe root cause would be the racy l2cap_sock_cleanup_listen() call\\nadded by the cited commit.\\n\\nbt_accept_dequeue() is called under lock_sock() except for\\nl2cap_sock_release().\\n\\nTwo threads could see the same socket during the list iteration\\nin bt_accept_dequeue():\\n\\n  CPU1                        CPU2 (close())\\n  ----                        ----\\n  sock_hold(sk)               sock_hold(sk);\\n  lock_sock(sk)   \u003c-- block close()\\n  sock_put(sk)\\n  bt_accept_unlink(sk)\\n    sock_put(sk)  \u003c-- refcnt by bt_accept_enqueue()\\n  release_sock(sk)\\n                              lock_sock(sk)\\n                              sock_put(sk)\\n                              bt_accept_unlink(sk)\\n                                sock_put(sk)        \u003c-- last refcnt\\n                              bt_accept_unlink(sk)  \u003c-- UAF\\n\\nDepending on the timing, the other thread could show up in the\\n\\\"Freed by task\\\" part.\\n\\nLet\u0027s call l2cap_sock_cleanup_listen() under lock_sock() in\\nl2cap_sock_release().\\n\\n[0]:\\nBUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]\\nBUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115\\nRead of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995\\nCPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full)\\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\\nCall Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:94 [inline]\\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\\n print_address_description mm/kasan/report.c:378 [inline]\\n print_report+0xcd/0x630 mm/kasan/report.c:482\\n kasan_report+0xe0/0x110 mm/kasan/report.c:595\\n debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]\\n do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115\\n spin_lock_bh include/linux/spinlock.h:356 [inline]\\n release_sock+0x21/0x220 net/core/sock.c:3746\\n bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312\\n l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451\\n l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425\\n __sock_release+0xb3/0x270 net/socket.c:649\\n sock_close+0x1c/0x30 net/socket.c:1439\\n __fput+0x3ff/0xb70 fs/file_table.c:468\\n task_work_run+0x14d/0x240 kernel/task_work.c:227\\n resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]\\n exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43\\n exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]\\n syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]\\n syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]\\n do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\nRIP: 0033:0x7f2accf8ebe9\\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\\nRSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4\\nRAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9\\nRDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003\\nRBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f\\nR10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c\\nR13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490\\n \u003c/TASK\u003e\\n\\nAllocated by task 5326:\\n kasan_save_stack+0x33/0x60 mm/kasan/common.c:47\\n kasan_save_track+0x14/0x30 mm/kasan/common.c:68\\n poison_kmalloc_redzone mm/kasan/common.c:388 [inline]\\n __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405\\n kasan_kmalloc include/linux/kasan.h:260 [inline]\\n __do_kmalloc_node mm/slub.c:4365 [inline]\\n __kmalloc_nopro\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/l2cap_sock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a2da00d1ea1abfb04f846638e210b5b5166e3c9c\",\"lessThan\":\"964cbb198f9c46c2b2358cd1faffc04c1e8248cf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"06f87c96216bc5cd1094c23492274f77f1d5dd3b\",\"lessThan\":\"83e1d9892ef51785cf0760b7681436760dda435a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fbe5a2fed8156cc19eb3b956602b0a1dd46a302d\",\"lessThan\":\"47f6090bcf75c369695d21c3f179db8a56bbbd49\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"29fac18499332211b2615ade356e2bd8b3269f98\",\"lessThan\":\"2ca99fc3512a8074de20ee52a87b492dfcc41a4d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1728137b33c00d5a2b5110ed7aafb42e7c32e4a1\",\"lessThan\":\"6077d16b5c0f65d571eee709de2f0541fb5ef0ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1728137b33c00d5a2b5110ed7aafb42e7c32e4a1\",\"lessThan\":\"306b0991413b482dbf5585b423022123bb505966\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1728137b33c00d5a2b5110ed7aafb42e7c32e4a1\",\"lessThan\":\"3dff390f55ccd9ce12e91233849769b5312180c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1728137b33c00d5a2b5110ed7aafb42e7c32e4a1\",\"lessThan\":\"862c628108562d8c7a516a900034823b381d3cba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51822644a047eac2310fab0799b64e3430b5a111\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"82cdb2ccbe43337798393369f0ceb98699fe6037\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"10426afe65c8bf7b24dd0c7be4dcc65f86fc99f9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.4.253\",\"lessThan\":\"5.4.299\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.190\",\"lessThan\":\"5.10.243\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.126\",\"lessThan\":\"5.15.192\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.45\",\"lessThan\":\"6.1.151\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.322\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.291\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.4.10\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/l2cap_sock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.299\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.243\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.192\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.151\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.105\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.46\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.6\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM RST2428P\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XCH328\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XCM324\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XCM328\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XCM332\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRH334 (24 V DC, 8xFO, CC)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (230 V AC, 12xFO)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (230 V AC, 8xFO)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (24 V DC, 12xFO)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (24 V DC, 8xFO)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (2x230 V AC, 12xFO)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (2x230 V AC, 8xFO)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC CN 4100\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V5.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.1,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.322\",\"versionEndExcluding\":\"4.15\",\"matchCriteriaId\":\"A396AAC4-8EF4-431E-A38C-9FC50FD1D13E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.291\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"562E7628-8B2C-4374-AD43-F402A8609611\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.253\",\"versionEndExcluding\":\"5.4.299\",\"matchCriteriaId\":\"41EAF279-6951-4E4E-8F31-F36E3247144D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.190\",\"versionEndExcluding\":\"5.10.243\",\"matchCriteriaId\":\"9F717FA9-F233-4FB8-9AA0-F0599A8B5D51\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.126\",\"versionEndExcluding\":\"5.15.192\",\"matchCriteriaId\":\"2F94D225-140F-4087-8A46-5B800EFE8626\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.45\",\"versionEndExcluding\":\"6.1.151\",\"matchCriteriaId\":\"41C177E8-5A46-428D-99B7-CEAD475640B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4.10\",\"versionEndExcluding\":\"6.6.105\",\"matchCriteriaId\":\"F92949FE-5947-42F7-B500-F06C788A606A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.46\",\"matchCriteriaId\":\"F7E2B332-E920-4CAC-B400-288602DB6F16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.6\",\"matchCriteriaId\":\"548F104C-0F08-438B-9C97-64C903F0C678\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"39982C4B-716E-4B2F-8196-FA301F47807D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"340BEEA9-D70D-4290-B502-FBB1032353B1\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2ca99fc3512a8074de20ee52a87b492dfcc41a4d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/306b0991413b482dbf5585b423022123bb505966\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3dff390f55ccd9ce12e91233849769b5312180c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/47f6090bcf75c369695d21c3f179db8a56bbbd49\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6077d16b5c0f65d571eee709de2f0541fb5ef0ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/83e1d9892ef51785cf0760b7681436760dda435a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/862c628108562d8c7a516a900034823b381d3cba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/964cbb198f9c46c2b2358cd1faffc04c1e8248cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-032379.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-089022.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:57:58+00:00",
      "cve": "CVE-2025-39860",
      "id": "CVE-2025-39860",
      "initial_release_date": "2025-09-19T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39860.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.