Race Condition in Linux Kernel Bluetooth Functionality

CVE-2025-40318

What is CVE-2025-40318?

A race condition vulnerability exists in the Linux kernel's Bluetooth functionality, specifically in the hci_cmd_sync_dequeue_once function. The issue arises when the function performs a lookup and subsequently attempts to cancel an entry without proper synchronization, allowing concurrent deletion by another function, hci_cmd_sync_work. This can lead to a double removal from the list, resulting in a Use After Free (UAF) scenario. The vulnerability has been addressed by ensuring that the cmd_sync_work_lock is held throughout both the lookup and cancel procedures, thereby preventing concurrent modifications and enhancing overall security.

References