CVE-2025-40308

What it actually does

NULL pointer dereference in bcsp_recv() when the BCSP protocol is not registered because the HCI_UART_REGISTERED flag is not checked before processing received data via hci_uart_tty_receive.

Why it matters to the business

Kernel crashes or denial of service on Linux systems using Bluetooth BCSP serial transport, leading to system instability and potential loss of Bluetooth functionality until reboot.

How an attack unfolds

A local attacker invokes tty ioctl operations that reach hci_uart_tty_receive and then bcsp_recv without the protocol being registered, triggering the null dereference; no widespread threat actor exploitation observed.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.4.302 or apply commit 39a7d40314b6288cfa2d13269275e9247a7a055a; for affected Ubuntu 16.04 packages update jasper to 1.900.1-debian1-2.4ubuntu1.3.

How to confirm the fix worked

Verify kernel source contains the HCI_UART_REGISTERED flag check before bcsp_recv processing; confirm running kernel version matches or exceeds listed fixed releases.

Typical attack path

1. Local process issues ioctl on a TTY device associated with an HCI UART
2. hci_uart_tty_receive is called with incoming data
3. bcsp_recv executes without HCI_UART_REGISTERED set
4. NULL pointer dereference occurs at drivers/bluetooth/hci_bcsp.c:590

How to detect it

Search kernel logs and dmesg for KASAN null-ptr-deref reports mentioning bcsp_recv or hci_bcsp.c; inspect call traces containing hci_uart_tty_receive and tiocsti.

• bcsp_recv+0x13d/0x1740
• KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
• hci_uart_tty_receive+0x194/0x220

What your security team should do

• Apply kernel updates to fixed versions immediately on all affected systems
• Disable Bluetooth BCSP interfaces when not required
• Monitor for kernel oops or KASAN reports referencing bcsp_recv