Use-After-Free Vulnerability in Linux Kernel Bluetooth Stack

CVE-2025-39860

What is CVE-2025-39860?

A vulnerability has been identified within the Bluetooth subsystem of the Linux kernel where a use-after-free condition may occur. This issue arises from concurrent calls to the bt_accept_dequeue() function and the l2cap_sock_cleanup_listen() function, which do not properly handle socket reference counts under certain conditions. Specifically, two threads could manipulate the same socket object simultaneously, leading to the potential for accessing freed memory. This flaw poses risks of undefined behavior and could be exploited to disrupt system stability or execute arbitrary code.

References