CVE-2025-40301 (GCVE-0-2025-40301)
Vulnerability from cvelistv5
Published
2025-12-08 00:46
Modified
2026-08-05 12:09
Severity ?
7.6 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate skb length for unknown CC opcode In hci_cmd_complete_evt(), if the command complete event has an unknown opcode, we assume the first byte of the remaining skb->data contains the return status. However, parameter data has previously been pulled in hci_event_func(), which may leave the skb empty. If so, using skb->data[0] for the return status uses un-init memory. The fix is to check skb->len before using skb->data.
References
Impacted products
Vendor Product Version
Linux Linux Version: afcb3369f46ed5dc883a7b92f2dd1e264d79d388
Version: afcb3369f46ed5dc883a7b92f2dd1e264d79d388
Version: afcb3369f46ed5dc883a7b92f2dd1e264d79d388
Version: afcb3369f46ed5dc883a7b92f2dd1e264d79d388
Version: afcb3369f46ed5dc883a7b92f2dd1e264d79d388
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fea895de78d3bb2f0c09db9f10b18f8121b15759",
              "status": "affected",
              "version": "afcb3369f46ed5dc883a7b92f2dd1e264d79d388",
              "versionType": "git"
            },
            {
              "lessThan": "779f83a91d4f1bf5ddfeaf528420cbb6dbf03fa8",
              "status": "affected",
              "version": "afcb3369f46ed5dc883a7b92f2dd1e264d79d388",
              "versionType": "git"
            },
            {
              "lessThan": "cf2c2acec1cf456c3d11c11a7589e886a0f963a9",
              "status": "affected",
              "version": "afcb3369f46ed5dc883a7b92f2dd1e264d79d388",
              "versionType": "git"
            },
            {
              "lessThan": "1a0ddaaf97405dbd11d4cb5a961a3f82400e8a50",
              "status": "affected",
              "version": "afcb3369f46ed5dc883a7b92f2dd1e264d79d388",
              "versionType": "git"
            },
            {
              "lessThan": "5c5f1f64681cc889d9b13e4a61285e9e029d6ab5",
              "status": "affected",
              "version": "afcb3369f46ed5dc883a7b92f2dd1e264d79d388",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: validate skb length for unknown CC opcode\n\nIn hci_cmd_complete_evt(), if the command complete event has an unknown\nopcode, we assume the first byte of the remaining skb-\u003edata contains the\nreturn status. However, parameter data has previously been pulled in\nhci_event_func(), which may leave the skb empty. If so, using skb-\u003edata[0]\nfor the return status uses un-init memory.\n\nThe fix is to check skb-\u003elen before using skb-\u003edata."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The malformed HCI Command Complete event is delivered by the Bluetooth controller into the host stack\u0027s event parser, reachable by an attacker in radio range who has compromised the controller firmware over the air or who supplies a hostile adapter. This matches the adjacent-network scoring used for other malformed-HCI-event handling defects in this subsystem.\nAC:L - Triggering is fully deterministic \u2014 a single Command Complete event with plen=3 and any opcode absent from hci_cc_table drives skb-\u003elen to 0 and reaches the unguarded skb-\u003edata[0] read. No race, timing window, or memory-layout condition is involved.\nPR:N - The event-processing path runs unconditionally on received HCI events with no authentication, pairing, or host-side capability check before hci_cmd_complete_evt() is entered. The attacker holds no credentials on the target system.\nUI:N - The HCI event is consumed automatically by hci_event_packet() in the Bluetooth rx path as soon as it arrives. No victim action is required.\nS:U - The uninitialized read and its consequences are confined to the kernel\u0027s Bluetooth subsystem, within the same security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:L - One byte of stale, uninitialized kernel heap memory is read and used as the HCI status, propagating to userspace only through lossy mappings (bt_to_errno() in __hci_cmd_sync_sk(), mgmt_status() in the mgmt path). This is a strictly bounded, low-fidelity disclosure rather than an arbitrary read.\nI:L - The garbage byte becomes the authoritative completion status for a pending HCI command, so a failing vendor command can be recorded as successful (or vice versa), corrupting hci_cmd_sync/mgmt state and device configuration decisions. The attacker modifies kernel state but has no control over the resulting value.\nA:H - Bogus command-completion status corrupts the HCI command state machine and can wedge or bring up the Bluetooth stack in an inconsistent state, and the access is an uninitialized-memory read that aborts the kernel under KMSAN/hardened configurations. The condition is remotely repeatable at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:20.526Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fea895de78d3bb2f0c09db9f10b18f8121b15759"
        },
        {
          "url": "https://git.kernel.org/stable/c/779f83a91d4f1bf5ddfeaf528420cbb6dbf03fa8"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf2c2acec1cf456c3d11c11a7589e886a0f963a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a0ddaaf97405dbd11d4cb5a961a3f82400e8a50"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c5f1f64681cc889d9b13e4a61285e9e029d6ab5"
        }
      ],
      "title": "Bluetooth: hci_event: validate skb length for unknown CC opcode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40301",
    "datePublished": "2025-12-08T00:46:24.863Z",
    "dateReserved": "2025-04-16T07:20:57.185Z",
    "dateUpdated": "2026-08-05T12:09:20.526Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.