CVE-2025-38304

What it actually does

NULL pointer dereference in Linux kernel Bluetooth EIR parsing function eir_get_service_data when optional len parameter is NULL and incorrectly used to advance to next service data entry.

Why it matters to the business

Kernel crashes or instability on systems with Bluetooth enabled, leading to device reboots, service disruption, and potential downtime for Linux-based endpoints, servers, and embedded devices; low but present exploitation risk given listed threat actor interest in similar kernel flaws.

How an attack unfolds

Attacker crafts malicious Bluetooth Extended Inquiry Response (EIR) data containing SERVICE_DATA entries with absent length fields and sends it via advertisement or connection; kernel path triggers eir_get_service_data with NULL len, dereferencing the pointer and causing panic or memory corruption usable for further privilege escalation by threat actors targeting Linux kernel.

How to fix it

Upgrade linux-lts packages to fixed versions: Alpaquita 23 to 6.1.81-r0, Alpaquita stream to 6.6.58-r0 or 6.12.41-r0; apply mainline commit 497c9d2d7d3983826bb02c10fb4a5818be6550fb or equivalent stable backports; disable Bluetooth if not required as temporary mitigation.

How to confirm the fix worked

Verify running kernel version matches or exceeds listed fixed releases; recompile or test with Bluetooth tools sending EIR_SERVICE_DATA packets containing NULL len fields and confirm absence of dereference oops in dmesg.

Typical attack path

1. Identify Linux target with Bluetooth stack enabled and reachable via wireless or paired device
2. Craft EIR packet with SERVICE_DATA entry omitting length field
3. Transmit malformed advertisement or response to trigger parsing
4. Trigger NULL dereference to crash kernel or chain into memory corruption for code execution

How to detect it

Search kernel logs and dmesg for oops or panic messages referencing eir_get_service_data or Bluetooth EIR parsing; correlate with unexpected Bluetooth advertisement traffic or device pairing attempts from untrusted sources.

• eir_get_service_data
• NULL pointer dereference.*Bluetooth
• EIR_SERVICE_DATA

What your security team should do

• Apply kernel updates to fixed versions immediately on all affected Linux distributions
• Audit Bluetooth usage and disable where unnecessary
• Monitor EPSS trend and threat actor activity around similar kernel privilege escalations
• Include in next patch cycle given 474 days since publication and downstream Linux prevalence