SECUFOCUSNOW
Home›CVE index›CVE-2025-40318
Review reviewHigh

CVE-2025-40318

Linux

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF". Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.

CVSS
8.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2025.12.08
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 8.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF". Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.

Affected product and versions

Product
Linux
Affected versions
>= f00f36db76eb8fd10d13e80e2590f23b5beaa54d < 0a94f7e017438935c09ef833a1aa908ad9875213, >= 1499f79995c7ee58e3bfeeff75f6d1b37dcda881 < 932c0a4f77ac13e526fdd5b42914d29c9821d389, >= 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 < ae76cf6c2c842944c6514c57df54d728f1916553, >= 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 < 9cd536970192b72257afcdfba0bfc09993e6f19c, >= 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 < 09b0cd1297b4dbfe736aeaa0ceeab2265f47f772, >= 357603f4d396d85fbf0045512efaf1d7f7394ed7, >= 6.1.120 < 6.1.159, >= 6.6.51 < 6.6.117, >= 6.8.9 < 6.9, >= 6.9
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available