huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-40170: kernel: net: use dst_dev_rcu() in sk_setup_caps()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.4 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: use dst_dev_rcu() in sk_setup_caps()

Use RCU to protect accesses to dst->dev from sk_setup_caps()
and sk_dst_gso_max_size().

Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(),
and ip_dst_mtu_maybe_forward().

ip4_dst_hoplimit() can use dst_dev_net_rcu().

Statement: Several paths read dst->dev without RCU. A concurrent dst/device teardown could cause a use-after-free—fixed by switching to dst_dev_rcu() and wrapping sections in rcu_read_lock(), mitigating a local DoS/LPE risk.
A local user floods route changes (device up/down, MTU/GSO tweaks, dst churn) while rapidly creating sockets, racing sk_setup_caps() to read dev after free that leads to kernel crash.

Affected upstream versions: 4.13
Fixed upstream versions: 0, 6.12.64, 6.17.3, 6.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5d1be493d1110c9e720b4c51a6e587bb2fb4ac12
CVE-2025-40176: kernel: tls: wait for pending async decryptions if tls_strp_msg_hold fails
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-11-12T00:00:00+00:00

A vulnerability was found in tls_decrypt_sg in net/tls/tls_sw.c in networking subsystem in the Linux Kernel.In this flaw, If it fails to clone of the input skb to hold the reference to the memory it uses may lead a use-after-free.


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.158, 6.12.55, 6.17.5, 6.18, 6.6.114
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9f83fd0c179e0f458e824e417f9d5ad53443f685
CVE-2025-40185: kernel: ice: ice_adapter: release xa entry on adapter allocation failure
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-11-12T00:00:00+00:00

A NULL pointer dereference exists in the Linux kernel such that  (ice: ice_adapter) fails to release a reserved XArray entry when ice_adapter_new() fails. As a result, subsequent insertions at the same index may return -EBUSY, which can lead to damage to system availability, integrity, and confidentiality.

Statement: ice_adapter_get() leaked a reserved XArray entry on adapter allocation failure, causing subsequent inserts to fail and potentially leading to a NULL pointer dereference. Impact is local DoS in the Intel ICE driver initialization path. Practical triggering typically requires privileged control over PCI/driver binding (hence for the CVSS the PR:H).

Affected upstream versions: 6.11
Fixed upstream versions: 0, 6.12.54, 6.17.4, 6.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7b9269de9815fc34d93dab90bd5169bacbe78e70
CVE-2025-40186: kernel: Linux kernel: Privilege escalation or Denial of Service via TCP Fast Open vulnerability
Component: kernel
Severity: Important
CWE: CWE-826 (Premature Release of Resource During Expected Lifetime)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-11-12T00:00:00+00:00

A flaw was found in the Linux kernel. A local attacker with low privileges could exploit a memory corruption vulnerability, specifically a use-after-free and double-free, within the TCP Fast Open (TFO) socket processing. This occurs when a listener is closed while a TFO socket is being processed in `tcp_conn_request()`. Successful exploitation could lead to a kernel panic, resulting in a Denial of Service (DoS), or potentially allow the attacker to execute arbitrary code with elevated privileges.

Statement: This vulnerability is rated Important for Red Hat Enterprise Linux. A local attacker with low privileges can exploit a use-after-free and double-free flaw in the Linux kernel's TCP Fast Open (TFO) implementation. This could lead to a kernel panic, resulting in a Denial of Service, or potentially allow for privilege escalation. This affects Red Hat Enterprise Linux 7, 8, 9 (up to 9.7.z), and 10 (up to 10.1.z).

Affected upstream versions: 5.4.300 < 5.4.301, 5.10.245 < 5.10.246, 5.15.194 < 5.15.195, 6.1.154 < 6.1.157, 6.6.108 < 6.6.113, 6.12.49 < 6.12.54, 6.16.9 < 6.17, 6.17
Fixed upstream versions: 0, 5.10.246, 5.15.195, 5.4.301, 6.1.157, 6.12.54, 6.17, 6.17.4, 6.18, 6.6.113
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e359b742eac1eac75cff4e38ee2e8cea492acd9b
CVE-2025-40210: kernel: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"
Component: kernel
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-11-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"

I've found that pynfs COMP6 now leaves the connection or lease in a
strange state, which causes CLOSE9 to hang indefinitely. I've dug
into it a little, but I haven't been able to root-cause it yet.
However, I bisected to commit 48aab1606fa8 ("NFSD: Remove the cap on
number of operations per NFSv4 COMPOUND").

Tianshuo Han also reports a potential vulnerability when decoding
an NFSv4 COMPOUND. An attacker can place an arbitrarily large op
count in the COMPOUND header, which results in:

[   51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total
pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO),
nodemask=(null),cpuset=/,mems_allowed=0

when NFSD attempts to allocate the COMPOUND op array.

Let's restore the operation-per-COMPOUND limit, but increased to 200
for now.

Statement: The revert restores a limit on the number of NFSv4 COMPOUND operations to prevent unbounded memory allocation.
Without this limit, a crafted request with a huge op count could trigger vmalloc overflow and could crash the kernel remotely.

Affected upstream versions: 6.17
Fixed upstream versions: 0, 6.17.8, 6.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b3ee7ce432289deac87b9d14e01f2fe6958f7f0b
CVE-2025-40237: kernel: fs/notify: call exportfs_encode_fid with s_umount
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-04T00:00:00+00:00

A flaw was found in the Linux kernel’s filesystem notification (fs/notify) code where calling inotify_show_fdinfo() on a file descriptor watching an overlayfs inode during an unmount operation could lead to a NULL pointer dereference.


Affected upstream versions: 6.6.72 < 6.6.73, 6.6.74 < 6.6.115, 6.12.10 < 6.12.56, 6.13
Fixed upstream versions: 0, 6.12.56, 6.17.6, 6.18, 6.6.115, 6.6.73
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 950b604384fd75d62e860bec7135b2b62eb4d508
CVE-2025-40240: kernel: sctp: avoid NULL dereference when chunk data buffer is missing
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

sctp: avoid NULL dereference when chunk data buffer is missing

chunk->skb pointer is dereferenced in the if-block where it's supposed
to be NULL only.

chunk->skb can only be NULL if chunk->head_skb is not. Check for frag_list
instead and do it just before replacing chunk->skb. We're sure that
otherwise chunk->skb is non-NULL because of outer if() condition.

Statement: A missing data buffer (frag_list) in SCTP chunk processing could trigger a NULL pointer dereference when handling GSO packets.
A remote attacker sending a malformed SCTP packet could cause a kernel crash (DoS).
The system is vulnerable only if CONFIG_IP_SCTP enabled in Kernel configuration (and for the Red Hat Enterprise Linux it is always disabled in older versions and enabled as module in latest versions only). However even if module exists in Red Hat Enterprise Linux, still admin need to specially enable it usage (make some SCTP listening port available) before exploitation would be possible.

Affected upstream versions: 4.8
Fixed upstream versions: 0, 5.10.246, 5.15.196, 5.4.301, 6.1.158, 6.12.56, 6.17.6, 6.18, 6.6.115
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 61cda2777b07d27459f5cac5a047c3edf9c8a1a9
CVE-2025-40248: kernel: Linux kernel: vsock vulnerability may lead to memory corruption
Component: kernel
Severity: Important
CWE: CWE-364 (Signal Handler Race Condition)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-04T00:00:00+00:00

A flaw was found in the Linux kernel's `vsock` component. This vulnerability occurs when a `connect()` operation on an already established socket is interrupted by a signal or timeout, causing the system to mishandle the socket's state. This incorrect handling can lead to a race condition, potentially resulting in memory corruption, such as a use-after-free or null-pointer dereference. A local attacker could exploit this to cause a denial of service or potentially escalate privileges.

Statement: This vulnerability is rated Important for Red Hat Enterprise Linux 7, 8, 9, and 10. A flaw in the Linux kernel's `vsock` component allows a local attacker to cause memory corruption, potentially leading to a denial of service or privilege escalation. This occurs when a `connect()` operation on an established socket is interrupted by a signal or timeout, leading to an incorrect handling of the socket's state.

Affected upstream versions: 3.9
Fixed upstream versions: 0, 5.10.247, 5.15.197, 5.4.302, 6.1.159, 6.12.60, 6.17.10, 6.18, 6.6.118
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3f71753935d648082a8279a97d30efe6b85be680
CVE-2025-40249: kernel: Kernel: Use-after-free in GPIO character device allows privilege escalation or denial of service
Component: kernel
Severity: Moderate
CWE: CWE-910 (Use of Expired File Descriptor)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-12-04T00:00:00+00:00

A flaw was found in the Linux kernel's GPIO (General Purpose Input/Output) character device. A local attacker with low privileges could exploit a use-after-free vulnerability. This occurs when a GPIO change event is emitted after a file descriptor's reference count has dropped to zero, but before its release callback is invoked. This could lead to privilege escalation or a denial of service.


Affected upstream versions: 6.13
Fixed upstream versions: 0, 6.17.10, 6.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dccc6daa8afa0f64c432e4c867f275747e3415e1
CVE-2025-40251: kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-12-04T00:00:00+00:00

A dangling pointer access problem was found while devl_rate_nodes_destroy in  net/devlink/rate.c in devlink in the Linux Kernel. This flaw may allow an attacker to cause a denial of service.


Affected upstream versions: 5.14
Fixed upstream versions: 0, 6.1.164, 6.12.60, 6.17.10, 6.18, 6.6.118
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 90e51e20bcec9bff5b2421ce1bd95704764655f5
CVE-2025-40252: kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()
Component: kernel
Severity: Moderate
CWE: CWE-170 (Improper Null Termination)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-04T00:00:00+00:00

QLogic qede driver processes TPA (TCP/IP Packet Aggregation) completion queue entries by iterating through len_list[] until hitting a zero terminator. Malformed or corrupted completion entries lacking this sentinel cause the loop to read beyond array bounds. SVACE static analysis identified that ARRAY_SIZE() bounds checking was absent in both qede_tpa_cont() and qede_tpa_end().

Statement: QLogic FastLinQ adapters running the qede driver face potential information disclosure or crashes from corrupted completion queue data. The vulnerability requires either hardware malfunction or ability to inject malformed DMA data.

Affected upstream versions: 4.6
Fixed upstream versions: 0, 5.15.197, 6.1.159, 6.12.60, 6.17.10, 6.18, 6.6.118
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ecbb12caf399d7cf364b7553ed5aebeaa2f255bc
CVE-2025-40257: kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling
Component: kernel
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-04T00:00:00+00:00

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. A race condition in the `mptcp_pm_del_add_timer()` function allows for a use-after-free vulnerability. This can be exploited by a local attacker to cause a denial of service (DoS), potentially leading to privilege escalation or arbitrary code execution.


Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.247, 5.15.197, 6.1.159, 6.12.60, 6.17.10, 6.18, 6.6.118
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9be29f8e7ce4e147e56caac2c3a0ce3573cf9c17
CVE-2025-40258: kernel: mptcp: fix race condition in mptcp_schedule_work()
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-04T00:00:00+00:00

A race in mptcp_schedule_work() could lead to a use-after-free: the function queued work and only then acquired a reference to the socket. If the worker ran to completion immediately, the subsequent sock_hold() operated on a freed object. Impact ranges from kernel crash (DoS) to potential privilege escalation for a local user able to create MPTCP sockets.

Statement: By default, the MPTCP support is disabled in RHEL. This bug is only applicable if enabled.
The MPTCP disabled by default (in Red Hat Enterprise Linux or Fedora). Particular this CVE looks higher severity, because could lead to privileges escalation potentially. The MPTCP is networking protocol (so if enabled by root, then potentially could be triggered). The protocol alive and being used in some scenarios, but known to be not safe enough to be enabled by default (need to use it with care taking in mind CVEs like this). There is one more similar previous CVE (one or two weeks ago) that is also MPTCP, but less danger that is CVE-2024-53122

Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.247, 5.15.197, 6.1.159, 6.12.60, 6.17.10, 6.18, 6.6.118
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f865e6595acf33083168db76921e66ace8bf0e5b
CVE-2025-40269: kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service
Component: kernel
Severity: Moderate
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-12-06T00:00:00+00:00

A flaw was found in the ALSA USB audio driver of the Linux kernel. This vulnerability, a buffer overflow, occurs when the size of the Pulse-Code Modulation (PCM) stream data packets exceeds the maximum allowed by the USB descriptor. A local attacker could exploit this by providing specially crafted USB audio device parameters, causing the PCM transfer buffer to overflow. This could lead to sensitive information disclosure and potentially result in a denial of service (DoS).


Affected upstream versions: 4.4.229 < 4.4.230, 4.9.229 < 4.9.230, 4.14.186 < 4.14.188, 4.19.130 < 4.19.132, 5.4.49 < 5.4.51, 5.7.6 < 5.7.8, 5.8
Fixed upstream versions: 0, 4.14.188, 4.19.132, 4.4.230, 4.9.230, 5.10.247, 5.15.197, 5.4.51, 5.7.8, 6.1.159, 6.12.59, 6.17.9, 6.18, 6.6.117
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 480a1490c595a242f27493a4544b3efb21b29f6a
CVE-2025-40271: kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of service.
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-06T00:00:00+00:00

A flaw was found in the Linux kernel. This use-after-free (UAF) vulnerability occurs in the `proc_readdir_de()` function within the `/proc` filesystem. A local attacker with low privileges can exploit this by concurrently traversing specific directories while network devices are unregistered. This can lead to a use-after-free condition, potentially resulting in information disclosure, privilege escalation, or a denial of service (DoS).

Statement: The vulnerability is a race condition in /proc directory enumeration, where a proc_dir_entry can be freed after rb_erase() but still referenced because the rbtree node is not cleared. A local unprivileged attacker can trigger a use-after-free by running getdents() (that calls proc_readdir_de()) in parallel with rapid creation and removal of network-related proc entries (e.g., tun devices). In practice this leads to a kernel NULL-pointer dereference or slab-UAF crash. Reliable exploitation beyond denial-of-service is unlikely due to the narrow timing window, but theoretically possible.
The bug could be triggered by the local attacker with the ability to create and remove network devices (e.g. CAP_NET_ADMIN).

Affected upstream versions: 3.19
Fixed upstream versions: 0, 5.10.247, 5.15.197, 5.4.302, 6.1.159, 6.12.59, 6.17.9, 6.18, 6.6.117
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1d1596d68a6f11d28f677eedf6cf5b17dbfeb491
CVE-2025-40277: kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-06T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

This data originates from userspace and is used in buffer offset
calculations which could potentially overflow causing an out-of-bounds
access.

Statement: A local attacker with access to the vmwgfx device could trigger an integer overflow when sending crafted SVGA3D command buffers with a malformed header size. The unchecked header->size field is used in buffer offset arithmetic, leading to potential out-of-bounds memory access in the kernel. The patch enforces a maximum bound (SVGA_CMD_MAX_DATASIZE) to prevent overflows. This issue may allow denial of service or privilege escalation within the guest VM.

Affected upstream versions: 4.3
Fixed upstream versions: 0, 5.10.247, 5.15.197, 5.4.302, 6.1.159, 6.12.59, 6.17.9, 6.18, 6.6.117
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e58559845021c3bad5e094219378b869157fad53
CVE-2025-40294: kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and denial of service
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-12-08T00:00:00+00:00

A flaw was found in the Linux kernel's Bluetooth management (MGMT) subsystem. A local attacker could exploit an out-of-bounds (OOB) write vulnerability in the `parse_adv_monitor_pattern()` function. This occurs when user-controlled input for the `length` variable exceeds the buffer's capacity during a copy operation, potentially leading to information disclosure and a denial of service (DoS).


Affected upstream versions: 6.1.83 < 6.1.159, 6.6
Fixed upstream versions: 0, 6.1.159, 6.12.58, 6.17.8, 6.18, 6.6.117
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 96616530f524a0a76248cd44201de0a9e8526190
CVE-2025-40300: kernel: x86/vmscape: Add conditional IBPB mitigation
Component: kernel
Severity: Moderate
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Public date: 2025-09-11T16:49:24.809000+00:00

In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest. Userspace can additionally be protected by flushing the branch predictors after a VMexit. Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and userspace will incur the most overhead from the new IBPB. This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is doubled up: one at context switch and another before running userspace. The intent is to integrate and optimize these cases post-embargo. [ dhansen: elaborate on suboptimal IBPB solution ]


Affected upstream versions: 3.16.57 < 3.17, 4.4.168 < 4.5, 4.16
Fixed upstream versions: 0, 3.17, 4.5, 5.10.244, 5.15.193, 6.1.152, 6.12.47, 6.16.7, 6.17, 6.6.106
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ac60717f9a8d21c58617d0b34274babf24135835
CVE-2025-40301: kernel: Linux kernel: Information disclosure and denial of service in Bluetooth HCI event handling
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

A flaw was found in the Linux kernel's Bluetooth component. A local attacker with low privileges could exploit a vulnerability in the Host Controller Interface (HCI) event processing. This issue arises from improper handling of command complete events with unknown opcodes, which can lead to the system attempting to read from uninitialized memory. Successful exploitation could result in the disclosure of sensitive information or cause the system to become unavailable (a denial of service).


Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.159, 6.12.58, 6.17.8, 6.18, 6.6.117
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fea895de78d3bb2f0c09db9f10b18f8121b15759