CVE-2025-22007

What it actually does

chan_alloc_skb_cb() returns NULL on error instead of an ERR_PTR, leading to NULL pointer dereference in the caller.

Why it matters to the business

Local Bluetooth operations can trigger kernel crashes or denial of service; high downstream package prevalence increases exposure across Linux distributions.

How an attack unfolds

An attacker triggers an error path during Bluetooth channel buffer allocation; the NULL return value is dereferenced, causing a crash or potential escalation when combined with other kernel flaws exploited by listed threat actors.

How to fix it

Upgrade affected packages to the listed fixed versions such as bind 32:9.11.4-26.P2.el8_1.5 (and equivalent for all listed bind-* packages); apply kernel updates addressing the Bluetooth skb allocation path.

How to confirm the fix worked

Confirm package versions match or exceed the fixed releases; inspect kernel source for chan_alloc_skb_cb() returning ERR_PTR on error; run Bluetooth channel allocation tests that previously hit the error path.

Typical attack path

1. Establish Bluetooth connection or channel that forces allocation failure
2. Trigger chan_alloc_skb_cb() error path
3. Dereference the returned NULL pointer

How to detect it

Review kernel logs for NULL pointer dereference in Bluetooth skb paths; correlate with Bluetooth channel setup events; watch for exploitation patterns seen in related kernel CVEs by the listed actors.

• NULL dereference in chan_alloc_skb_cb
• Bluetooth channel allocation failure followed by kernel oops
• skb_cb allocation returning 0x0

What your security team should do

• Prioritize patching within 30 days given ecosystem prevalence
• Monitor for related kernel privilege escalation activity from listed threat actors
• Harden Bluetooth stack if not required
• Verify fixed package versions across all distributions