CVE-2025-40282
BaseFortify
Publication date: 2025-12-06
Last updated on: 2025-12-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's Bluetooth 6lowpan implementation occurs because the link-local header is not properly reset on the IPv6 receive path. Specifically, the missing call to skb_reset_mac_header() for the uncompressed IPv6 RX path can cause kernel crashes when receiving packets, such as with AF_PACKET SOCK_RAW sockets. The issue arises because the netdev has header_ops and requires the link-local header to be set correctly for received skb packets to avoid crashes.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash when processing certain Bluetooth 6lowpan IPv6 packets, leading to system instability or denial of service. Applications or systems using Bluetooth 6lowpan with raw socket packet reception could experience unexpected kernel bugs or crashes, potentially disrupting normal operation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for specific BUG messages related to Bluetooth 6lowpan, such as 'kernel BUG at net/core/skbuff.c:212!' and call traces involving net/bluetooth/6lowpan.c. You can use commands like 'dmesg | grep -i 6lowpan' or 'journalctl -k | grep -i 6lowpan' to check for these kernel BUG messages indicating the issue.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is fixed, as the issue is resolved by adding missing skb_reset_mac_header() calls in the Bluetooth 6lowpan code. Until an update is applied, you may consider disabling Bluetooth 6lowpan functionality if possible to avoid triggering the bug.