Out-of-Bounds Access in Linux Kernel Bluetooth Functionality

CVE-2025-40294

What is CVE-2025-40294?

In the Linux kernel, a vulnerability was identified within the Bluetooth functionality, specifically in the parse_adv_monitor_pattern() function. This flaw arises from improper limitations on the 'length' variable, which, when manipulated, allows for out-of-bounds access to the 'value' array in the mgmt_adv_pattern structure. As the array is capped at a size of 31, if user input exceeds this size, it may lead to unauthorized access and potential application crashes. To mitigate this issue, it's recommended to revert the limits for 'offset' and 'length' back to HCI_MAX_AD_LENGTH, preventing such access violations and maintaining user space integrity.

References