Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-40213— Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于Bluetooth MGMT中set_mesh_sync和set_mesh_complete函数存在栈溢出和双重删除，可能导致崩溃。

CVSS 7.8 · High EPSS 0.14% · P3

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a< 31d6c9216aa1be18ba317239738f73b0b0c7b691 affected
d71b98f253b079cbadc83266383f26fe7e9e103b< 5c19daa93d9af29f1f46251b47e1ea66bcc8d679 affected
302a1f674c00dd5581ab8e493ef44767c5101aab< 1c9aca1787e8395a2c59fef20e914467958969c5 affected
302a1f674c00dd5581ab8e493ef44767c5101aab< e8785404de06a69d89dcdd1e9a0b6ea42dc6d327 affected
87a1f16f07c6c43771754075e08f45b41d237421 affected
6.6.140< 6.6.160 affected
6.16.10< 6.17 affected
6.17 affected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-40213

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to memcpy from badly declared on-stack flexible array. Another crash is in set_mesh_complete() due to double list_del via mgmt_pending_valid + mgmt_pending_remove. Use DEFINE_FLEX to declare the flexible array right, and don't memcpy outside bounds. As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free, and also report status on error.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于Bluetooth MGMT中set_mesh_sync和set_mesh_complete函数存在栈溢出和双重删除，可能导致崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a ~ 31d6c9216aa1be18ba317239738f73b0b0c7b691 -
Linux Linux 6.17 -

II. Public POCs for CVE-2025-40213

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-40213

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-40213 (1)

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-40213

No comments yet

Leave a comment