CVE-2025-39860

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock...

Affected product and versions

Product

Linux Linux, RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family

Affected versions

>= a2da00d1ea1abfb04f846638e210b5b5166e3c9c < 964cbb198f9c46c2b2358cd1faffc04c1e8248cf, >= 06f87c96216bc5cd1094c23492274f77f1d5dd3b < 83e1d9892ef51785cf0760b7681436760dda435a, >= fbe5a2fed8156cc19eb3b956602b0a1dd46a302d < 47f6090bcf75c369695d21c3f179db8a56bbbd49, >= 29fac18499332211b2615ade356e2bd8b3269f98 < 2ca99fc3512a8074de20ee52a87b492dfcc41a4d, >= 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 < 6077d16b5c0f65d571eee709de2f0541fb5ef0ca, >= 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 < 306b0991413b482dbf5585b423022123bb505966, >= 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 < 3dff390f55ccd9ce12e91233849769b5312180c2, >= 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 < 862c628108562d8c7a516a900034823b381d3cba, >= 51822644a047eac2310fab0799b64e3430b5a111, >= 82cdb2ccbe43337798393369f0ceb98699fe6037, >= 10426afe65c8bf7b24dd0c7be4dcc65f86fc99f9, >= 5.4.253 < 5.4.299, >= 5.10.190 < 5.10.243, >= 5.15.126 < 5.15.192, >= 6.1.45 < 6.1.151, >= 4.14.322 < 4.15, >= 4.19.291 < 4.20, >= 6.4.10 < 6.5, >= 6.5, < V3.3

Fixed versions

4.15, 4.20, 5.4.299, 5.10.243, 5.15.192, 6.1.151, 6.6.105, 6.12.46, 6.16.6

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416