CVE-2025-40294

What it actually does

Out-of-bounds memory access in the Linux kernel Bluetooth MGMT subsystem when parse_adv_monitor_pattern() copies user-supplied advertisement monitor patterns whose length field exceeds the 31-byte size of the value array in mgmt_adv_pattern.

Why it matters to the business

Attackers with access to the Bluetooth management interface on Linux systems can trigger kernel crashes, memory corruption, or potential code execution, leading to denial of service or elevated privileges on affected hosts.

How an attack unfolds

An attacker with sufficient privileges sends a crafted MGMT command containing an advertisement monitor pattern with a length value between 32 and 251; the kernel copies this into a fixed 31-byte array, resulting in an out-of-bounds read or write.

How to fix it

Upgrade the Linux kernel to version 6.1.159 or later, or apply commit 96616530f524a0a76248cd44201de0a9e8526190. Reboot affected systems after the update.

How to confirm the fix worked

Verify the running kernel version is at least 6.1.159; confirm the presence of the fix commit in the kernel source tree; test that MGMT advertisement monitor pattern lengths are now limited to HCI_MAX_AD_LENGTH.

Typical attack path

1. Obtain access to the Bluetooth management socket (typically requires CAP_NET_ADMIN or equivalent).
2. Construct an MGMT_OP_ADD_ADV_MONITOR_PATTERN command with pattern length > 31.
3. Submit the command via the mgmt interface.
4. Trigger the out-of-bounds copy in parse_adv_monitor_pattern().
5. Achieve kernel panic, memory corruption, or arbitrary code execution.

How to detect it

Review kernel logs for oops or panic messages referencing parse_adv_monitor_pattern or mgmt_adv_pattern; inspect audit logs for unusual MGMT socket activity; check for processes issuing Bluetooth management commands with oversized advertisement patterns.

What your security team should do

• Apply the kernel update to 6.1.159 or newer on all Linux hosts as the highest priority.
• Restrict access to the Bluetooth management socket to only trusted processes.
• Monitor for kernel oops or panics involving Bluetooth MGMT functions.
• Audit systems for use of the mgmt interface and limit Bluetooth functionality where unnecessary.