CVE-2025-68305

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sock: Prevent race in socket write iter and sock bind

There is a potential race condition between sock bind and socket write

iter. bind may free the same cmd via mgmt_pending before write iter sends

the cmd, just as syzbot reported in UAF[1].

Here we use hci_dev_lock to synchronize the two, thereby avoiding the

UAF mentioned in [1].

[1]

syzbot reported:

BUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316

Read of size 8 at addr ffff888077164818 by task syz.0.17/5989

Call Trace:

mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316

set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918

hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719

hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839

sock_sendmsg_nosec net/socket.c:727 [inline]

__sock_sendmsg+0x21c/0x270 net/socket.c:742

sock_write_iter+0x279/0x360 net/socket.c:1195

Allocated by

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References