CVE-2025-38592
BaseFortify
Publication date: 2025-08-19
Last updated on: 2025-11-26
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a bug in the Linux kernel's Bluetooth component, specifically in the hci_devcd_dump function. It occurs because two functions, dev_coredumpv and skb_put_data, both use the same buffer (hdev->dump.head). However, dev_coredumpv can free this buffer if the data has not yet been read by userspace, leading to a use-after-free scenario. When skb_put_data then tries to access this freed buffer, it causes a vmalloc-out-of-bounds error, which can crash the system.
How can this vulnerability impact me? :
This vulnerability can cause a system crash due to an out-of-bounds memory access in the Bluetooth subsystem of the Linux kernel. This can lead to denial of service (DoS) by crashing the kernel, potentially disrupting normal operation of the affected system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for kernel crash reports or logs indicating a vmalloc-out-of-bounds error related to Bluetooth's hci_devcd_dump function. Specifically, look for KASAN (Kernel Address Sanitizer) reports showing vmalloc-out-of-bounds in skb_put_data or hci_devcd_dump. Commands to check kernel logs include: `dmesg | grep -i 'vmalloc-out-of-bounds'` or `journalctl -k | grep -i 'hci_devcd_dump'`. Additionally, enabling KASAN in the kernel can help detect such memory errors during testing.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the issue is fixed by reordering the dev_coredumpv call to occur after skb_put_data, preventing the out-of-bounds access. If an immediate kernel update is not possible, consider disabling Bluetooth device coredump functionality temporarily to avoid triggering the vulnerable code path.