CVE-2025-40318

What it actually does

Race condition in hci_cmd_sync_dequeue_once allows concurrent list entry deletion by hci_cmd_sync_work, resulting in double list_del and use-after-free.

Why it matters to the business

Kernel instability or potential privilege escalation on Linux systems using Bluetooth, increasing crash risk and security exposure for servers, desktops, and embedded devices.

How an attack unfolds

An attacker triggers concurrent Bluetooth command queue operations to hit the window between lookup and cancel under separate locks, forcing double deletion and UAF for memory corruption.

How to fix it

Upgrade Linux kernel to version 6.1.159 or later, or apply commit 0a94f7e017438935c09ef833a1aa908ad9875213 from the stable git tree.

How to confirm the fix worked

Verify running kernel version is at least 6.1.159 and confirm presence of the locking fix around cmd_sync_work_lock in hci_sync.c.

Typical attack path

1. Establish Bluetooth connection or trigger hci command sync operations
2. Race hci_cmd_sync_dequeue_once lookup with hci_cmd_sync_work deletion
3. Trigger double list_del leading to UAF
4. Leverage freed object for memory corruption or code execution

How to detect it

Review kernel logs for list corruption warnings, double-free panics, or Bluetooth hci command queue errors around the time of suspected activity; correlate with unusual Bluetooth usage.

What your security team should do

• Apply kernel updates immediately on all Bluetooth-enabled systems
• Disable Bluetooth where not required to reduce attack surface
• Monitor for kernel oops or UAF reports in dmesg after patching