Bluetooth Use-After-Free Vulnerability in Linux Kernel

CVE-2025-38250

What is CVE-2025-38250?

A use-after-free vulnerability in the Linux kernel's Bluetooth subsystem could be exploited by attackers. When a vhci file descriptor is closed while another thread is executing an ioctl() operation, it can lead to a situation where resources are freed while still in use. This lack of proper synchronization, particularly during device unregistration, raises the risk of concurrent access to freed memory, potentially allowing unauthorized code execution or crashing of the system. It is recommended to apply the latest patches that implement SRCU for synchronization during critical operations to safeguard against such vulnerabilities.

References