CVE-2025-38593

What it actually does

Race condition in hci_discovery_filter_clear() allows concurrent kfree() of the uuids array without locking, resulting in double free and subsequent slab corruption in the Linux kernel Bluetooth stack.

Why it matters to the business

Kernel crashes or potential memory corruption on Linux systems using Bluetooth can lead to denial of service, unexpected reboots, and in some cases local privilege escalation, disrupting operations especially in container and embedded environments with high downstream package prevalence.

How an attack unfolds

An attacker with local access triggers Bluetooth socket operations that concurrently invoke hci_discovery_filter_clear() via hci_cmd_sync_work and start_service_discovery paths; the race leads to double free and a kernel BUG, with potential exploitation chains noted in campaigns involving VMSCAPE and related Linux kernel privilege escalations.

How to fix it

Apply kernel patch 86f3dcd1f331cfd4fd7ec88906955134ec51afbe or upgrade affected packages to fixed versions such as openjdk-11-openj9* (Chainguard) 0.53.0-r0; rebuild and reboot systems after update.

How to confirm the fix worked

Verify kernel commit or package version matches the fixed revisions; reproduce the backtrace path under concurrent Bluetooth discovery loads to confirm absence of the race; monitor for slab allocator BUGs post-deployment.

Typical attack path

1. Obtain local access or compromise a process with Bluetooth socket privileges
2. Issue concurrent HCI socket writev calls that invoke start_service_discovery and passive scan updates
3. Trigger preemption between kfree(uuids) and NULL assignment in hci_discovery_filter_clear
4. Cause double free and trigger slab allocator BUG
5. Leverage resulting memory corruption for further exploitation or denial of service

How to detect it

Search kernel logs for slab allocator BUGs at mm/slub.c, backtraces containing start_service_discovery, hci_sock_sendmsg, and kfree calls originating from bluetoothd or HCI socket operations; inspect dmesg and audit logs for concurrent service discovery patterns.

• kernel BUG at mm/slub.c:547
• start_service_discovery+0x1d0/0x2c0
• hci_sock_sendmsg+0x518/0x924
• __slab_free+0xf8/0x348
• Tainted: G O 6.12.19-kernel
• el0t_64_sync+0x194/0x198

What your security team should do

• Prioritize patching Linux kernel Bluetooth subsystems on all affected hosts within standard maintenance windows
• Disable unnecessary Bluetooth services where feasible until patches are applied
• Monitor EPSS trend and threat actor activity for any increase in observed exploitation
• Update Chainguard images to 0.53.0-r0 across dependent containers
• Incorporate double-free race detection into kernel fuzzing and CI pipelines