CVE-2025-40318: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcisync: fix race in hcicmdsyncdequeueonce
hcicmdsyncdequeueonce() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hcicmdsyncwork() can also delete the same entry, leading to double listdel() and "UAF".
Fix this by holding cmdsyncworklock across both lookup and cancel, so that the entry cannot be removed concurrently.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40318?
CVE-2025-40318 has been classified with a moderate severity level due to the potential impact on Bluetooth functionality.
How do I fix CVE-2025-40318?
To mitigate CVE-2025-40318, it is recommended to update the Linux kernel to the latest stable version that addresses this vulnerability.
What is the impact of CVE-2025-40318 on affected systems?
CVE-2025-40318 can lead to race conditions in Bluetooth processing, potentially causing system instability or Bluetooth connection issues.
When was CVE-2025-40318 reported?
CVE-2025-40318 was publicly reported in 2025 following the discovery of the issue in the Linux kernel's Bluetooth subsystem.
Is CVE-2025-40318 a hardware or software vulnerability?
CVE-2025-40318 is classified as a software vulnerability specifically affecting the Linux kernel.