CVE-2025-40301

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40301", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.185Z", "datePublished": "2025-12-08T00:46:24.863Z", "dateUpdated": "2026-08-05T12:09:20.526Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:09:20.526Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: validate skb length for unknown CC opcode\n\nIn hci_cmd_complete_evt(), if the command complete event has an unknown\nopcode, we assume the first byte of the remaining skb->data contains the\nreturn status. However, parameter data has previously been pulled in\nhci_event_func(), which may leave the skb empty. If so, using skb->data[0]\nfor the return status uses un-init memory.\n\nThe fix is to check skb->len before using skb->data."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "baseScore": 7.6, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The malformed HCI Command Complete event is delivered by the Bluetooth controller into the host stack's event parser, reachable by an attacker in radio range who has compromised the controller firmware over the air or who supplies a hostile adapter. This matches the adjacent-network scoring used for other malformed-HCI-event handling defects in this subsystem.\nAC:L - Triggering is fully deterministic \u2014 a single Command Complete event with plen=3 and any opcode absent from hci_cc_table drives skb->len to 0 and reaches the unguarded skb->data[0] read. No race, timing window, or memory-layout condition is involved.\nPR:N - The event-processing path runs unconditionally on received HCI events with no authentication, pairing, or host-side capability check before hci_cmd_complete_evt() is entered. The attacker holds no credentials on the target system.\nUI:N - The HCI event is consumed automatically by hci_event_packet() in the Bluetooth rx path as soon as it arrives. No victim action is required.\nS:U - The uninitialized read and its consequences are confined to the kernel's Bluetooth subsystem, within the same security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:L - One byte of stale, uninitialized kernel heap memory is read and used as the HCI status, propagating to userspace only through lossy mappings (bt_to_errno() in __hci_cmd_sync_sk(), mgmt_status() in the mgmt path). This is a strictly bounded, low-fidelity disclosure rather than an arbitrary read.\nI:L - The garbage byte becomes the authoritative completion status for a pending HCI command, so a failing vendor command can be recorded as successful (or vice versa), corrupting hci_cmd_sync/mgmt state and device configuration decisions. The attacker modifies kernel state but has no control over the resulting value.\nA:H - Bogus command-completion status corrupts the HCI command state machine and can wedge or bring up the Bluetooth stack in an inconsistent state, and the access is an uninitialized-memory read that aborts the kernel under KMSAN/hardened configurations. The condition is remotely repeatable at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/hci_event.c"], "versions": [{"version": "afcb3369f46ed5dc883a7b92f2dd1e264d79d388", "lessThan": "fea895de78d3bb2f0c09db9f10b18f8121b15759", "status": "affected", "versionType": "git"}, {"version": "afcb3369f46ed5dc883a7b92f2dd1e264d79d388", "lessThan": "779f83a91d4f1bf5ddfeaf528420cbb6dbf03fa8", "status": "affected", "versionType": "git"}, {"version": "afcb3369f46ed5dc883a7b92f2dd1e264d79d388", "lessThan": "cf2c2acec1cf456c3d11c11a7589e886a0f963a9", "status": "affected", "versionType": "git"}, {"version": "afcb3369f46ed5dc883a7b92f2dd1e264d79d388", "lessThan": "1a0ddaaf97405dbd11d4cb5a961a3f82400e8a50", "status": "affected", "versionType": "git"}, {"version": "afcb3369f46ed5dc883a7b92f2dd1e264d79d388", "lessThan": "5c5f1f64681cc889d9b13e4a61285e9e029d6ab5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/hci_event.c"], "versions": [{"version": "6.1", "status": "affected"}, {"version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.159", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.117", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.58", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.8", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.159"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.6.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.12.58"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.17.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fea895de78d3bb2f0c09db9f10b18f8121b15759"}, {"url": "https://git.kernel.org/stable/c/779f83a91d4f1bf5ddfeaf528420cbb6dbf03fa8"}, {"url": "https://git.kernel.org/stable/c/cf2c2acec1cf456c3d11c11a7589e886a0f963a9"}, {"url": "https://git.kernel.org/stable/c/1a0ddaaf97405dbd11d4cb5a961a3f82400e8a50"}, {"url": "https://git.kernel.org/stable/c/5c5f1f64681cc889d9b13e4a61285e9e029d6ab5"}], "title": "Bluetooth: hci_event: validate skb length for unknown CC opcode", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/hci_event.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fea895de78d3bb2f0c09db9f10b18f8121b15759", "status": "affected", "version": "afcb3369f46ed5dc883a7b92f2dd1e264d79d388", "versionType": "git"}, {"lessThan": "779f83a91d4f1bf5ddfeaf528420cbb6dbf03fa8", "status": "affected", "version": "afcb3369f46ed5dc883a7b92f2dd1e264d79d388", "versionType": "git"}, {"lessThan": "cf2c2acec1cf456c3d11c11a7589e886a0f963a9", "status": "affected", "version": "afcb3369f46ed5dc883a7b92f2dd1e264d79d388", "versionType": "git"}, {"lessThan": "1a0ddaaf97405dbd11d4cb5a961a3f82400e8a50", "status": "affected", "version": "afcb3369f46ed5dc883a7b92f2dd1e264d79d388", "versionType": "git"}, {"lessThan": "5c5f1f64681cc889d9b13e4a61285e9e029d6ab5", "status": "affected", "version": "afcb3369f46ed5dc883a7b92f2dd1e264d79d388", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/hci_event.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.159", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.117", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.58", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: validate skb length for unknown CC opcode\n\nIn hci_cmd_complete_evt(), if the command complete event has an unknown\nopcode, we assume the first byte of the remaining skb->data contains the\nreturn status. However, parameter data has previously been pulled in\nhci_event_func(), which may leave the skb empty. If so, using skb->data[0]\nfor the return status uses un-init memory.\n\nThe fix is to check skb->len before using skb->data."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: hci_event: validar la longitud de skb para un c\u00f3digo de operaci\u00f3n CC desconocido\n\nEn hci_cmd_complete_evt(), si el evento de comando completado tiene un c\u00f3digo de operaci\u00f3n desconocido, asumimos que el primer byte de los datos restantes de skb -> data contiene el estado de retorno. Sin embargo, los datos del par\u00e1metro han sido extra\u00eddos previamente en hci_event_func(), lo que puede dejar el skb vac\u00edo. Si es as\u00ed, usar skb -> data[0] para el estado de retorno utiliza memoria no inicializada.\n\nLa soluci\u00f3n es verificar skb -> len antes de usar skb -> data."}], "id": "CVE-2025-40301", "lastModified": "2026-10-14T22:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-12-08T01:16:02.183", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1a0ddaaf97405dbd11d4cb5a961a3f82400e8a50"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5c5f1f64681cc889d9b13e4a61285e9e029d6ab5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/779f83a91d4f1bf5ddfeaf528420cbb6dbf03fa8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cf2c2acec1cf456c3d11c11a7589e886a0f963a9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fea895de78d3bb2f0c09db9f10b18f8121b15759"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: Bluetooth: hci_event: validate skb length for unknown CC opcode", "id": "2419896", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419896"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40301", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40301\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40301\nhttps://lore.kernel.org/linux-cve-announce/2025120819-CVE-2025-40301-4d3b@gregkh/T"], "threat_severity": "Important"}

{}