CVE-2025-40294: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
Bluetooth: MGMT: Fix OOB access in parseadvmonitorpattern()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
To avoid OOB access, revert the limits for 'offset' in the parse_adv_monitor_pattern() function (after user-controlled pattern[i].length may exceed the mgmt_adv_pattern 'value' array size of 31).
Linux kernel Bluetooth MGMT (parse_adv_monitor_pattern) offset limits = revert limits for 'offset' - Configuration
In parse_adv_monitor_pattern(), revert the 'length' variable so it is limited back to HCI_MAX_AD_LENGTH; currently 'length' is limited to HCI_MAX_EXT_AD_LENGTH(251), which allows patterns[i].value (array size 31) to be accessed out of bounds when copied.
Linux kernel Bluetooth MGMT (parse_adv_monitor_pattern) patterns[i].value array length handling = set 'length' back to HCI_MAX_AD_LENGTH
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40294?
CVE-2025-40294 has a high severity due to the risk of out-of-bounds memory access in the Linux kernel's Bluetooth functionality.
How do I fix CVE-2025-40294?
The fix for CVE-2025-40294 is to upgrade to the latest version of the Linux kernel where the issue has been patched.
What systems are affected by CVE-2025-40294?
CVE-2025-40294 affects all versions of the Linux kernel that utilize the Bluetooth MGMT subsystem.
What type of vulnerability is CVE-2025-40294?
CVE-2025-40294 is characterized as an out-of-bounds access vulnerability in the Linux kernel.
Can CVE-2025-40294 be exploited remotely?
CVE-2025-40294 may allow for remote code execution if exploited through the Bluetooth stack.