CVE-2025-39860

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()

syzbot reported the splat below without a repro.

In the splat, a single thread calling bt_accept_dequeue() freed sk

and touched it after that.

The root cause would be the racy l2cap_sock_cleanup_listen() call

added by the cited commit.

bt_accept_dequeue() is called under lock_sock() except for

l2cap_sock_release().

Two threads could see the same socket during the list iteration

in bt_accept_dequeue():

CPU1 CPU2 (close())

---- ----

sock_hold(sk) sock_hold(sk);

lock_sock(sk) <-- block close()

sock_put(sk)

bt_accept_unlink(sk)

sock_put(sk) <-- refcnt by bt_accept_enqueue()

release_sock(sk)

lock_sock(sk)

sock_put(sk)

bt_accept_unlink(sk)

sock_put(sk)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References