CVE-2025-39981

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix possible UAFs

This attemps to fix possible UAFs caused by struct mgmt_pending being

freed while still being processed like in the following trace, in order

to fix mgmt_pending_valid is introduce and use to check if the

mgmt_pending hasn't been removed from the pending list, on the complete

callbacks it is used to check and in addtion remove the cmd from the list

while holding mgmt_pending_lock to avoid TOCTOU problems since if the cmd

is left on the list it can still be accessed and freed.

BUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223

Read of size 8 at addr ffff8880709d4dc0 by task kworker/u11:0/55

CPU: 0 UID: 0 PID: 55 Comm: kworker/u11:0 Not tainted 6.16.4 #2 PREEMPT(full)

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014

Workqueue: hci0 hci_cmd_sync_work

Call Trace:

<TASK>

dump_stack_lvl+0x189/

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References