CVE-2025-40283

CVE-2025-40283

High · published December 7, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF

There is a KASAN: slab-use-after-free read in btusb_disconnect().

Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will

free the btusb data associated with the interface. The same data is

then used later in the function, hence the UAF.

Fix by moving the accesses to btusb data to before the data is free'd.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00142 · 3.2th percentile
Published
2025-12-07T03:15Z
References (8)
https://git.kernel.org/stable/c/1c28c1e1522c773a94e26950ffb145e88cd9834b · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/23d22f2f71768034d6ef86168213843fc49bf550 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/297dbf87989e09af98f81f2bcb938041785557e8 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5dc00065a0496c36694afe11e52a5bc64524a9b8 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7a6d1e740220ff9dfcb6a8c994d6ba49e76db198 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/95b9b98c93b1c0916a3d4cf4540b7f5d69145a0d · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a2610ecd9fd5708be8997ca8f033e4200c0bb6af · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f858f004bc343a7ae9f2533bbb2a3ab27428532f · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 06 DEC 21:51Z
    Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
    cvelistv5