CVE-2025-40284
BaseFortify
Publication date: 2025-12-06
Last updated on: 2025-12-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's Bluetooth mesh management. Specifically, a timer called mesh_send_done is not canceled when the Bluetooth device (hdev) is removed. If the timer triggers after the device is gone, it causes a crash due to use-after-free errors. The fix involves canceling this timer when the device is removed to prevent such crashes.
How can this vulnerability impact me? :
This vulnerability can cause the Linux system to crash sporadically when the Bluetooth mesh send timer triggers after the Bluetooth device has been removed. This can lead to system instability or downtime, potentially affecting any services or applications relying on Bluetooth mesh functionality.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring system logs for crash messages related to Bluetooth mesh send timers, specifically looking for BUG reports such as 'KASAN: slab-use-after-free in run_timer_softirq'. You can check the kernel logs using commands like 'dmesg | grep -i kasan' or 'journalctl -k | grep -i kasan' to identify related use-after-free errors triggered by Bluetooth mesh operations.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the Bluetooth MGMT mesh send timer is properly canceled when the hdev is removed. This fix prevents crashes caused by the timer triggering after device removal. Until an update is applied, avoid using Bluetooth mesh features that may trigger this timer to reduce the risk of system crashes.