CVE-2025-40301

What it actually does

Use of uninitialized memory in hci_cmd_complete_evt when an unknown opcode command complete event arrives after parameter data has been pulled from the skb, leaving it empty and causing skb->data[0] to reference uninitialized kernel memory.

Why it matters to the business

Kernel memory corruption on Bluetooth-enabled Linux systems can lead to crashes, denial of service, or potential information disclosure affecting device stability and requiring urgent patching across fleets.

How an attack unfolds

An attacker with the ability to inject Bluetooth HCI events sends a command complete event containing an unknown opcode after prior parameter data has emptied the skb; the handler then reads from uninitialized memory without length validation.

How to fix it

Update the Linux kernel to the fixed commit fea895de78d3bb2f0c09db9f10b18f8121b15759 or apply the equivalent stable backport that adds skb length validation before accessing data in hci_cmd_complete_evt. Rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the presence of the length check (skb->len) in hci_cmd_complete_evt source after patching; verify running kernel version contains the fix and test with synthetic unknown-opcode command complete events that would previously have triggered uninitialized access.

Typical attack path

1. Gain proximity or control sufficient to deliver crafted HCI events to the target Bluetooth stack
2. Trigger hci_cmd_complete_evt with unknown opcode after hci_event_func has consumed parameter data
3. Force skb->len check bypass to dereference skb->data[0] containing uninitialized memory
4. Observe resulting kernel panic, memory disclosure, or corruption effects

How to detect it

Review kernel logs for hci_cmd_complete_evt entries referencing unknown opcodes immediately followed by memory faults or skb length warnings; correlate with Bluetooth event traces showing unexpected command complete events.

What your security team should do

• Prioritize kernel updates on all Bluetooth-enabled hosts within 30 days given the memory corruption class
• Disable Bluetooth where not required until patches are deployed
• Monitor kernel logs for hci_event and skb-related warnings during rollout