CVE-2025-40318 (GCVE-0-2025-40318)

Vulnerability from cvelistv5 – Published: 2025-12-08 00:46 – Updated: 2026-10-15 22:02
VLAI
Title
Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF". Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 21:59 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6843 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f00f36db76eb8fd10d13e80e2590f23b5beaa54d , < 0a94f7e017438935c09ef833a1aa908ad9875213 (git)
Affected: 1499f79995c7ee58e3bfeeff75f6d1b37dcda881 , < 932c0a4f77ac13e526fdd5b42914d29c9821d389 (git)
Affected: 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 , < ae76cf6c2c842944c6514c57df54d728f1916553 (git)
Affected: 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 , < 9cd536970192b72257afcdfba0bfc09993e6f19c (git)
Affected: 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 , < 09b0cd1297b4dbfe736aeaa0ceeab2265f47f772 (git)
Affected: 357603f4d396d85fbf0045512efaf1d7f7394ed7 (git)
Affected: 6.1.120 , < 6.1.159 (semver)
Affected: 6.6.51 , < 6.6.117 (semver)
Affected: 6.8.9 , < 6.9 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.1.159 , ≤ 6.1.* (semver)
Unaffected: 6.6.117 , ≤ 6.6.* (semver)
Unaffected: 6.12.58 , ≤ 6.12.* (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40318",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:59:09.036526Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:02:43.644Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0a94f7e017438935c09ef833a1aa908ad9875213",
              "status": "affected",
              "version": "f00f36db76eb8fd10d13e80e2590f23b5beaa54d",
              "versionType": "git"
            },
            {
              "lessThan": "932c0a4f77ac13e526fdd5b42914d29c9821d389",
              "status": "affected",
              "version": "1499f79995c7ee58e3bfeeff75f6d1b37dcda881",
              "versionType": "git"
            },
            {
              "lessThan": "ae76cf6c2c842944c6514c57df54d728f1916553",
              "status": "affected",
              "version": "505ea2b295929e7be2b4e1bc86ee31cb7862fb01",
              "versionType": "git"
            },
            {
              "lessThan": "9cd536970192b72257afcdfba0bfc09993e6f19c",
              "status": "affected",
              "version": "505ea2b295929e7be2b4e1bc86ee31cb7862fb01",
              "versionType": "git"
            },
            {
              "lessThan": "09b0cd1297b4dbfe736aeaa0ceeab2265f47f772",
              "status": "affected",
              "version": "505ea2b295929e7be2b4e1bc86ee31cb7862fb01",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "357603f4d396d85fbf0045512efaf1d7f7394ed7",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.159",
              "status": "affected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.117",
              "status": "affected",
              "version": "6.6.51",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "6.1.120",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "6.6.51",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once\n\nhci_cmd_sync_dequeue_once() does lookup and then cancel\nthe entry under two separate lock sections. Meanwhile,\nhci_cmd_sync_work() can also delete the same entry,\nleading to double list_del() and \"UAF\".\n\nFix this by holding cmd_sync_work_lock across both\nlookup and cancel, so that the entry cannot be removed\nconcurrently."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The flaw is in the Bluetooth HCI command-sync queue, and the create-connection entries it manages are queued and aborted in response to LE/ACL link events from a peer in radio range (advertising reports driving `check_pending_le_conn()`, and `le_conn_timeout` when the peer stops responding). An attacker within Bluetooth range can drive both the queue and cancel sides without any local access.\nAC:L - The attacker controls both sides of the race \u2014 repeatedly forcing connection attempts and aborts cycles `hci_cancel_connect_sync()` against the `cmd_sync_work` kthread draining the same list entry, and the attempt can be retried without limit. The window sits between two lock acquisitions in the same function with the worker on a separate CPU, making it readily hit on SMP.\nPR:N - The adjacent attacker holds no credentials on the target: the LE create-connection queue/cancel cycle happens entirely before pairing or authentication completes. Even on the purely local path only an unprivileged AF_BLUETOOTH socket is needed, since `l2cap_sock_create()` gates only SOCK_RAW behind CAP_NET_RAW.\nUI:N - Background LE auto-connect and connection-timeout handling proceed autonomously in kernel workqueues with no victim action. No file must be opened, device mounted, or prompt accepted.\nS:U - The corruption is confined to kernel heap objects managed by the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed. Impact is standard in-kernel compromise.\nC:H - The use-after-free reads `entry-\u003edestroy` and `entry-\u003edata` out of a freed kmalloc-64 object and dereferences them, and the resulting hijacked call plus double-`list_del` write primitive can be leveraged into arbitrary kernel memory disclosure. Freed-slab reads alone already expose adjacent kernel heap contents.\nI:H - `_hci_cmd_sync_cancel_entry()` calls a function pointer read from freed memory and then performs a double `list_del()` that writes attacker-groomable pointers to attacker-groomable addresses, plus a double `kfree()`. That combination is a direct control-flow-hijack and arbitrary-write path to full kernel code execution.\nA:H - Without successful grooming the same code path dereferences LIST_POISON or freed slab contents, producing a `list_del corruption` BUG, GPF, or panic. The double free additionally corrupts the slab allocator, crashing the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:29.032Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0a94f7e017438935c09ef833a1aa908ad9875213"
        },
        {
          "url": "https://git.kernel.org/stable/c/932c0a4f77ac13e526fdd5b42914d29c9821d389"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae76cf6c2c842944c6514c57df54d728f1916553"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cd536970192b72257afcdfba0bfc09993e6f19c"
        },
        {
          "url": "https://git.kernel.org/stable/c/09b0cd1297b4dbfe736aeaa0ceeab2265f47f772"
        }
      ],
      "title": "Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40318",
    "datePublished": "2025-12-08T00:46:45.382Z",
    "dateReserved": "2025-04-16T07:20:57.186Z",
    "dateUpdated": "2026-10-15T22:02:43.644Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40318",
      "date": "2026-10-22",
      "epss": "0.0027",
      "percentile": "0.1823"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/hci_sync.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0a94f7e017438935c09ef833a1aa908ad9875213",
                    "status": "affected",
                    "version": "f00f36db76eb8fd10d13e80e2590f23b5beaa54d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "932c0a4f77ac13e526fdd5b42914d29c9821d389",
                    "status": "affected",
                    "version": "1499f79995c7ee58e3bfeeff75f6d1b37dcda881",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ae76cf6c2c842944c6514c57df54d728f1916553",
                    "status": "affected",
                    "version": "505ea2b295929e7be2b4e1bc86ee31cb7862fb01",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9cd536970192b72257afcdfba0bfc09993e6f19c",
                    "status": "affected",
                    "version": "505ea2b295929e7be2b4e1bc86ee31cb7862fb01",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "09b0cd1297b4dbfe736aeaa0ceeab2265f47f772",
                    "status": "affected",
                    "version": "505ea2b295929e7be2b4e1bc86ee31cb7862fb01",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "357603f4d396d85fbf0045512efaf1d7f7394ed7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1.159",
                    "status": "affected",
                    "version": "6.1.120",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.117",
                    "status": "affected",
                    "version": "6.6.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.9",
                    "status": "affected",
                    "version": "6.8.9",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/hci_sync.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.9"
                  },
                  {
                    "lessThan": "6.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.159",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.117",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.58",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once\n\nhci_cmd_sync_dequeue_once() does lookup and then cancel\nthe entry under two separate lock sections. Meanwhile,\nhci_cmd_sync_work() can also delete the same entry,\nleading to double list_del() and \"UAF\".\n\nFix this by holding cmd_sync_work_lock across both\nlookup and cancel, so that the entry cannot be removed\nconcurrently."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: hci_sync: correcci\u00f3n de condici\u00f3n de carrera en hci_cmd_sync_dequeue_once\n\nhci_cmd_sync_dequeue_once() realiza una b\u00fasqueda y luego cancela la entrada bajo dos secciones de bloqueo separadas. Mientras tanto, hci_cmd_sync_work() tambi\u00e9n puede eliminar la misma entrada, lo que lleva a un doble list_del() y \u0027UAF\u0027.\n\nEsto se soluciona manteniendo cmd_sync_work_lock durante la b\u00fasqueda y la cancelaci\u00f3n, para que la entrada no pueda ser eliminada concurrentemente."
          }
        ],
        "id": "CVE-2025-40318",
        "lastModified": "2026-10-15T22:19:07.860",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-40318",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:59:09.036526Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-08T01:16:04.413",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/09b0cd1297b4dbfe736aeaa0ceeab2265f47f772"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0a94f7e017438935c09ef833a1aa908ad9875213"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/932c0a4f77ac13e526fdd5b42914d29c9821d389"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9cd536970192b72257afcdfba0bfc09993e6f19c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ae76cf6c2c842944c6514c57df54d728f1916553"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:37:33+00:00",
      "cve": "CVE-2025-40318",
      "id": "CVE-2025-40318",
      "initial_release_date": "2025-12-08T00:00:00+00:00",
      "product_status:fixed": "1224",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40318.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.