BaseFortify

Publication date: 2025-12-06

Last updated on: 2025-12-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF There is a KASAN: slab-use-after-free read in btusb_disconnect(). Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will free the btusb data associated with the interface. The same data is then used later in the function, hence the UAF. Fix by moving the accesses to btusb data to before the data is free'd.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-06

Last Modified

2025-12-08

Generated

2026-07-06

AI Q&A

2025-12-07

EPSS Evaluated

2026-07-05

NVD

CVE-2025-40283

EUVD

EUVD-2025-201572

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's Bluetooth USB driver (btusb). Specifically, in the btusb_disconnect() function, the driver frees the btusb data associated with a USB interface but then continues to access that freed data later in the same function. This improper ordering leads to a use-after-free condition, which can cause memory corruption or crashes. The fix involved reordering the cleanup steps to ensure that the btusb data is accessed only before it is freed.

Impact Analysis

This use-after-free vulnerability can lead to memory corruption or system instability in the Linux kernel's Bluetooth USB driver. Exploiting this flaw could potentially allow an attacker to execute arbitrary code, cause denial of service (system crashes), or escalate privileges on affected systems that use the vulnerable Bluetooth driver.

Hi! I’m here to help you understand CVE-2025-40283. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70