CVE-2025-38250

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Fix use-after-free in vhci_flush()

syzbot reported use-after-free in vhci_flush() without repro. [0]

From the splat, a thread close()d a vhci file descriptor while

its device was being used by iotcl() on another thread.

Once the last fd refcnt is released, vhci_release() calls

hci_unregister_dev(), hci_free_dev(), and kfree() for struct

vhci_data, which is set to hci_dev->dev->driver_data.

The problem is that there is no synchronisation after unlinking

hdev from hci_dev_list in hci_unregister_dev(). There might be

another thread still accessing the hdev which was fetched before

the unlink operation.

We can use SRCU for such synchronisation.

Let's run hci_dev_reset() under SRCU and wait for its completion

in hci_unregister_dev().

Another option would be to restore hci_dev->destruct(), which was

removed in commit 587ae086f6e4 ("Bluetooth: Remove unused

hci-destruct cb"). However, this would

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References