BaseFortify

Publication date: 2026-01-13

Last updated on: 2026-03-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This ties the lifetime of all the btusb data to the binding of a driver to one interface, INTF. In a driver that binds to other interfaces, ISOC and DIAG, this is an accident waiting to happen. The issue is revealed in btusb_disconnect(), where calling usb_driver_release_interface(&btusb_driver, data->intf) will have devm free the data that is also being used by the other interfaces of the driver that may not be released yet. To fix this, revert the use of devm and go back to freeing memory explicitly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-13

Last Modified

2026-03-25

Generated

2026-07-06

AI Q&A

2026-01-14

EPSS Evaluated

2026-07-05

NVD

CVE-2025-71082

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	3.7
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	From 6.13 (inc) to 6.18.4 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.160 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.120 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.64 (exc)
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	From 3.7.1 (inc) to 5.15.198 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Impact Analysis

The vulnerability can cause memory corruption or use-after-free errors in the Bluetooth USB driver when multiple interfaces are involved. This can lead to system instability, crashes, or potentially allow attackers to execute arbitrary code or cause denial of service via the Bluetooth subsystem.

Executive Summary

This vulnerability occurs in the Linux kernel's Bluetooth USB driver (btusb). The issue arises because the driver uses devm_kzalloc() to allocate memory tied to a single interface's lifetime. When the driver binds to multiple interfaces, freeing memory for one interface prematurely frees data still used by other interfaces, leading to potential use-after-free or memory corruption. The fix was to revert to explicit memory management instead of devm_kzalloc().

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version where the btusb driver no longer uses devm_kzalloc for allocating btusb data and instead explicitly frees memory. This involves applying the patch that reverts the use of devm_kzalloc in btusb.c, ensuring proper memory management and preventing premature freeing of data used by multiple interfaces.

Hi! I’m here to help you understand CVE-2025-71082. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70