CVE-2025-40301

About vulnerability

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate skb length for unknown CC opcode In hci_cmd_complete_evt(), if the command complete event has an unknown opcode, we assume the first byte of the remaining skb->data contains the return status. However, parameter data has previously been pulled in hci_event_func(), which may leave the skb empty. If so, using skb->data[0] for the return status uses un-init memory. The fix is to check skb->len before using skb->data. A flaw was found in the Linux kernel’s Bluetooth component. A local attacker with low privileges could exploit a vulnerability in the Host Controller Interface (HCI) event processing. This issue arises from improper handling of command complete events with unknown opcodes, which can lead to the system attempting to read from uninitialized memory. Successful exploitation could result in the disclosure of sensitive information or cause the system to become unavailable (a denial of service).

Live-patch status from KernelCare for each operating system.