Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-37918— Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于btusb模块在处理QCA固件崩溃转储时错误返回0，可能导致空指针取消引用。

CVSS 8.8 · High EPSS 0.24% · P14

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux 20981ce2d5a5f79d17da1ace3a93df7b3c6ba3d6< 2e8d44ebaa7babdd5c5ab50ca275826e241920d6 affected
20981ce2d5a5f79d17da1ace3a93df7b3c6ba3d6< b70b41591ec48c78ec6a885e1f57bfc4029e5e13 affected
20981ce2d5a5f79d17da1ace3a93df7b3c6ba3d6< 8563d9fabd8a4b726ba7acab4737c438bf11a059 affected
20981ce2d5a5f79d17da1ace3a93df7b3c6ba3d6< 0317b033abcd1d8dd2798f0e2de5e84543d0bd22 affected
6.4 affected
< 6.4 unaffected
6.6.90≤ 6.6.* unaffected
6.12.28≤ 6.12.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-37918

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() A NULL pointer dereference can occur in skb_dequeue() when processing a QCA firmware crash dump on WCN7851 (0489:e0f3). [ 93.672166] Bluetooth: hci0: ACL memdump size(589824) [ 93.672475] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 93.672517] Workqueue: hci0 hci_devcd_rx [bluetooth] [ 93.672598] RIP: 0010:skb_dequeue+0x50/0x80 The issue stems from handle_dump_pkt_qca() returning 0 even when a dump packet is successfully processed. This is because it incorrectly forwards the return value of hci_devcd_init() (which returns 0 on success). As a result, the caller (btusb_recv_acl_qca() or btusb_recv_evt_qca()) assumes the packet was not handled and passes it to hci_recv_frame(), leading to premature kfree() of the skb. Later, hci_devcd_rx() attempts to dequeue the same skb from the dump queue, resulting in a NULL pointer dereference. Fix this by: 1. Making handle_dump_pkt_qca() return 0 on success and negative errno on failure, consistent with kernel conventions. 2. Splitting dump packet detection into separate functions for ACL and event packets for better structure and readability. This ensures dump packets are properly identified and consumed, avoiding double handling and preventing NULL pointer access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于btusb模块在处理QCA固件崩溃转储时错误返回0，可能导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 20981ce2d5a5f79d17da1ace3a93df7b3c6ba3d6 ~ 2e8d44ebaa7babdd5c5ab50ca275826e241920d6 -
Linux Linux 6.4 -

II. Public POCs for CVE-2025-37918

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-37918

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-05-20 · 95 CVEs total

CVE-2025-37894 9.8 CRITICAL net: use sock_gen_put() when sk_state is TCP_TIME_WAIT
CVE-2025-37924 9.8 CRITICAL ksmbd: fix use-after-free in kerberos authentication
CVE-2025-37935 9.8 CRITICAL net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM
CVE-2025-37959 9.4 CRITICAL bpf: Scrub packet on bpf_redirect_peer
CVE-2025-37926 8.8 HIGH ksmbd: fix use-after-free in ksmbd_session_rpc_open
CVE-2025-37899 8.8 HIGH ksmbd: fix use-after-free in session logoff
CVE-2025-37944 8.8 HIGH wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
CVE-2025-37943 8.8 HIGH wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi
CVE-2025-37947 8.8 HIGH ksmbd: prevent out-of-bounds stream writes by validating *pos
CVE-2025-37952 8.8 HIGH ksmbd: Fix UAF in __close_file_table_ids
CVE-2025-37956 8.8 HIGH ksmbd: prevent rename with empty string
CVE-2025-37957 8.8 HIGH KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception
CVE-2025-37936 8.7 HIGH perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value.
CVE-2025-37973 8.1 HIGH wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation
CVE-2025-37921 7.8 HIGH vxlan: vnifilter: Fix unlocked deletion of default FDB entry
CVE-2025-37920 7.8 HIGH xsk: Fix race condition in AF_XDP generic RX path
CVE-2025-37923 7.8 HIGH tracing: Fix oob write in trace_seq_to_buffer()
CVE-2025-37964 7.8 HIGH x86/mm: Eliminate window where TLB flushes may be inadvertently skipped
CVE-2025-37903 7.8 HIGH drm/amd/display: Fix slab-use-after-free in hdcp
CVE-2025-37977 7.8 HIGH scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set

Showing top 20 of 95 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-37918

No comments yet

Leave a comment