Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2025-38117— Bluetooth: MGMT: Protect mgmt_pending list with its own lock

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于Bluetooth MGMT未保护mgmt_pending列表，可能导致空指针取消引用。

CVSS 7.8 · High EPSS 0.18% · P7 Updated Oct 16, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 12

Vendor	Product	Version Range	Status
Linux	Linux	`a380b6cff1a2d2139772e88219d08330f84d0381< 7b5958332f20dc66b19be564c402dbc21b927a81`	affected
		`a380b6cff1a2d2139772e88219d08330f84d0381< bdd56875c6926d8009914f427df71797693e90d4`	affected
		`a380b6cff1a2d2139772e88219d08330f84d0381< 4e83f2dbb2bf677e614109df24426c4dded472d4`	affected
		`a380b6cff1a2d2139772e88219d08330f84d0381< d7882db79135c829a922daf3571f33ea1e056ae3`	affected
		`a380b6cff1a2d2139772e88219d08330f84d0381< 6fe26f694c824b8a4dbf50c635bee1302e3f099c`	affected
		`4.1`	affected
		`< 4.1`	unaffected
		`6.1.184≤ 6.1.*`	unaffected
… +4 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-38117

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Bluetooth: MGMT: Protect mgmt_pending list with its own lock

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Protect mgmt_pending list with its own lock This uses a mutex to protect from concurrent access of mgmt_pending list which can cause crashes like: ================================================================== BUG: KASAN: slab-use-after-free in hci_sock_get_channel+0x60/0x68 net/bluetooth/hci_sock.c:91 Read of size 2 at addr ffff0000c48885b2 by task syz.4.334/7318 CPU: 0 UID: 0 PID: 7318 Comm: syz.4.334 Not tainted 6.15.0-rc7-syzkaller-g187899f4124a #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xa8/0x254 mm/kasan/report.c:408 print_report+0x68/0x84 mm/kasan/report.c:521 kasan_report+0xb0/0x110 mm/kasan/report.c:634 __asan_report_load2_noabort+0x20/0x2c mm/kasan/report_generic.c:379 hci_sock_get_channel+0x60/0x68 net/bluetooth/hci_sock.c:91 mgmt_pending_find+0x7c/0x140 net/bluetooth/mgmt_util.c:223 pending_find net/bluetooth/mgmt.c:947 [inline] remove_adv_monitor+0x44/0x1a4 net/bluetooth/mgmt.c:5445 hci_mgmt_cmd+0x780/0xc00 net/bluetooth/hci_sock.c:1712 hci_sock_sendmsg+0x544/0xbb0 net/bluetooth/hci_sock.c:1832 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg net/socket.c:727 [inline] sock_write_iter+0x25c/0x378 net/socket.c:1131 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x62c/0x97c fs/read_write.c:684 ksys_write+0x120/0x210 fs/read_write.c:736 __do_sys_write fs/read_write.c:747 [inline] __se_sys_write fs/read_write.c:744 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:744 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Allocated by task 7037: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:562 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4327 [inline] __kmalloc_noprof+0x2fc/0x4c8 mm/slub.c:4339 kmalloc_noprof include/linux/slab.h:909 [inline] sk_prot_alloc+0xc4/0x1f0 net/core/sock.c:2198 sk_alloc+0x44/0x3ac net/core/sock.c:2254 bt_sock_alloc+0x4c/0x300 net/bluetooth/af_bluetooth.c:148 hci_sock_create+0xa8/0x194 net/bluetooth/hci_sock.c:2202 bt_sock_create+0x14c/0x24c net/bluetooth/af_bluetooth.c:132 __sock_create+0x43c/0x91c net/socket.c:1541 sock_create net/socket.c:1599 [inline] __sys_socket_create net/socket.c:1636 [inline] __sys_socket+0xd4/0x1c0 net/socket.c:1683 __do_sys_socket net/socket.c:1697 [inline] __se_sys_socket net/socket.c:1695 [inline] __arm64_sys_socket+0x7c/0x94 net/socket.c:1695 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Freed by task 6607: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x68/0x88 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline ---truncated---

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	a380b6cff1a2d2139772e88219d08330f84d0381 ~ 7b5958332f20dc66b19be564c402dbc21b927a81	-
Linux	Linux	4.1	-

II. Public POCs for CVE-2025-38117

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2025-38117

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-38117 (1)

🔗 Making sure you're not a bot!

https://www.cve.org/CVERecord?id=CVE-2025-38117

Same Patch Batch · Linux · 2025-07-03 · 78 CVEs total

CVE-2025-38123	9.8 CRITICAL	net: wwan: t7xx: Fix napi rx poll issue
CVE-2025-38139	9.8 CRITICAL	netfs: Fix oops in write-retry from mis-resetting the subreq iterator
CVE-2025-38120	9.4 CRITICAL	netfilter: nf_set_pipapo_avx2: fix initial map fill
CVE-2025-38146	9.4 CRITICAL	net: openvswitch: Fix the dead loop of MPLS parse
CVE-2025-38141	7.8 HIGH	dm: fix dm_blk_report_zones
CVE-2025-38168	7.8 HIGH	perf: arm-ni: Unregister PMUs on probe failure
CVE-2025-38162	7.8 HIGH	netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
CVE-2025-38154	7.8 HIGH	bpf, sockmap: Avoid using sk_socket after free when sending
CVE-2025-38106	7.8 HIGH	io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()
CVE-2025-38150	7.8 HIGH	af_packet: move notifier's packet_dev_mc out of rcu critical section
CVE-2025-38108	7.8 HIGH	net_sched: red: fix a race in __red_change()
CVE-2025-38110	7.8 HIGH	net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
CVE-2025-38111	7.8 HIGH	net/mdiobus: Fix potential out-of-bounds read/write access
CVE-2025-38107	7.8 HIGH	net_sched: ets: fix a race in ets_qdisc_change()
CVE-2025-38116	7.8 HIGH	wifi: ath12k: fix uaf in ath12k_core_init()
CVE-2025-38115	7.8 HIGH	net_sched: sch_sfq: fix a potential crash on gso_skb handling
CVE-2025-38118	7.8 HIGH	Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
CVE-2025-38133	7.8 HIGH	iio: adc: ad4851: fix ad4858 chan pointer handling
CVE-2025-38129	7.8 HIGH	page_pool: Fix use-after-free in page_pool_recycle_in_ring
CVE-2025-38127	7.8 HIGH	ice: fix Tx scheduler error handling in XDP callback

Showing top 20 of 78 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2025-38117

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-38117— Bluetooth: MGMT: Protect mgmt_pending list with its own lock

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 12

I. Basic Information for CVE-2025-38117

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2025-38117

III. Intelligence Information for CVE-2025-38117

Patches & Fixes for CVE-2025-38117 (1)

Same Patch Batch · Linux · 2025-07-03 · 78 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2025-38117

Leave a comment