Bluetooth Command Handling Vulnerability in Linux Kernel

CVE-2025-38128

What is CVE-2025-38128?

A vulnerability exists within the Linux kernel's Bluetooth management layer that involves improper handling of malformed HCI_CMD_SYNC commands. When parameters in the 'mgmt_hci_cmd_sync()' function do not match the expected size, it creates the potential for out-of-bounds memory access. Specifically, if an overly large 'params_len' is received, it leads to the misuse of memory allocation functions, allowing for possible exploitation. This issue highlights the need for strict input validation in Bluetooth command processing to prevent corrupt data from causing undefined behavior.

References