CVE-2025-38118

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete

This reworks MGMT_OP_REMOVE_ADV_MONITOR to not use mgmt_pending_add to

avoid crashes like bellow:

==================================================================

BUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_complete+0xe5/0x540 net/bluetooth/mgmt.c:5406

Read of size 8 at addr ffff88801c53f318 by task kworker/u5:5/5341

CPU: 0 UID: 0 PID: 5341 Comm: kworker/u5:5 Not tainted 6.15.0-syzkaller-10402-g4cb6c8af8591 #0 PREEMPT(full)

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014

Workqueue: hci0 hci_cmd_sync_work

Call Trace:

<TASK>

dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120

print_address_description mm/kasan/report.c:408 [inline]

print_report+0xd2/0x2b0 mm/kasan/report.c:521

kasan_report+0x118/0x150 mm/kasan/report.c:634

mgmt_remove_adv_monitor_complete+0xe5/0x540 net/bluetooth/mgmt.c:5

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References