CVE-2025-38099

What it actually does

The vulnerability permits SCO Bluetooth connections when READ_VOICE_SETTING is unsupported or broken, allowing an improper voice_setting value that causes the Bluetooth controller to lock up and become unresponsive.

Why it matters to the business

Bluetooth audio and voice features become unavailable on affected Linux systems, disrupting headsets, hands-free devices, and any applications relying on SCO connections until the system or controller is reset.

How an attack unfolds

An attacker with the ability to initiate or influence Bluetooth SCO connections supplies an unsupported or malformed voice_setting during connection setup, triggering the controller lockup condition before the kernel can disable SCO support.

How to fix it

Update the Linux kernel to the fixed commit f48ee562c095e552a30b8d9cc0566a267b410f8a or an equivalent stable release that disables SCO support when READ_VOICE_SETTING is unsupported; apply the same fixed version 0.13.1-r1 for any affected terraform-provider-time packages.

How to confirm the fix worked

Confirm the running kernel contains commit f48ee562c095e552a30b8d9cc0566a267b410f8a, verify SCO connections are rejected or handled safely when voice settings are invalid, and test that the controller remains responsive after attempted SCO setup.

Typical attack path

1. Establish a Bluetooth connection to a vulnerable Linux host
2. Request or negotiate an SCO link for audio/voice
3. Supply an unsupported or broken voice_setting value
4. Trigger controller lockup resulting in denial of service

How to detect it

Inspect kernel and Bluetooth daemon logs for SCO connection attempts followed by controller reset or lockup messages; correlate with failed voice setting reads on systems that have not yet applied the patch.

What your security team should do

• Prioritize kernel updates on all systems exposing Bluetooth
• Disable Bluetooth SCO or the entire Bluetooth stack where not required
• Monitor for controller lockup events in system logs
• Review downstream package dependencies for the listed fixed versions