CVE-2025-38303

What it actually does

Missing length checks in eir_create_adv_data allow the kernel to write EIR_FLAGS and EIR_TX_POWER fields into an advertising data buffer without verifying remaining space, resulting in an out-of-bounds write that crashes the Bluetooth subsystem.

Why it matters to the business

Local users or processes can trigger kernel-level Bluetooth crashes, causing denial of service on systems that rely on Bluetooth for connectivity or input devices; widespread Linux distributions and embedded devices increase exposure across fleets.

How an attack unfolds

An attacker with local access crafts or triggers Bluetooth advertising data generation that exceeds the allocated EIR buffer size; the unchecked addition of flags and transmit-power fields overwrites adjacent memory, leading to a crash. Related Linux kernel privilege-escalation campaigns demonstrate active interest in similar kernel flaws.

How to fix it

Upgrade linux-lts packages to the listed fixed versions: 6.1.81-r0 (Alpaquita 23), 6.6.58-r0 or 6.12.41-r0 (Alpaquita stream), or kernel commit 2af40d795d3fb0ee5c074b7ac56ab22402aa6e4f. Rebuild and reboot after applying updates; disable Bluetooth if not required.

How to confirm the fix worked

Confirm the running kernel contains the fix commit or matches the patched package versions above; attempt to reproduce the crash condition with crafted EIR data and verify the kernel no longer panics.

Typical attack path

1. Obtain local code execution or user shell on target Linux system
2. Trigger Bluetooth stack paths that call eir_create_adv_data with oversized data
3. Cause out-of-bounds write and subsequent kernel panic or Bluetooth service crash
4. Repeat to sustain denial of service

How to detect it

Review kernel logs for Bluetooth EIR-related oops or panic messages; correlate with process activity that interacts with the Bluetooth HCI or advertising APIs; examine audit logs for unexpected local Bluetooth configuration changes.

What your security team should do

• Prioritize patching all affected Linux kernel packages within the next 30 days given rising EPSS trend
• Inventory systems running linux-lts and schedule reboots after upgrade
• Disable Bluetooth services where not operationally necessary
• Monitor vendor advisories for additional backported fixes