CVE-2025-40284
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: cancel mesh send timer when hdev removed mesh_send_done timer is not canceled when hdev is removed, which causes crash if the timer triggers after hdev is gone. Cancel the timer when MGMT removes the hdev, like other MGMT timers. Should fix the BUG: sporadically seen by BlueZ test bot (in "Mesh - Send cancel - 1" test). Log: ------ BUG: KASAN: slab-use-after-free in run_timer_softirq+0x76b/0x7d0 ... Freed by task 36: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x43/0x70 kfree+0x103/0x500 device_release+0x9a/0x210 kobject_put+0x100/0x1e0 vhci_release+0x18b/0x240 ------
How to fix
- Linux Linux990e6143b0ca0c66f099d67d00c112bf59b30d76, 2927ff643607eddf4f03d10ef80fe10d977154aa, 7b6b6c077cad0601d62c3c34ab7ce3fb25deda7b, fd62ca5ad136dcf6f5aa308423b299a6be6f54ea, 55fb52ffdd62850d667ebed842815e072d3c9961 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | b338d91703fae6f6afd67f3f75caa3b8f36ddef3 ≤ v < 990e6143b0ca0c66f099d67d00c112bf59b30d76, b338d91703fae6f6afd67f3f75caa3b8f36ddef3 ≤ v < 2927ff643607eddf4f03d10ef80fe10d977154aa, b338d91703fae6f6afd67f3f75caa3b8f36ddef3 ≤ v < 7b6b6c077cad0601d62c3c34ab7ce3fb25deda7b, b338d91703fae6f6afd67f3f75caa3b8f36ddef3 ≤ v < fd62ca5ad136dcf6f5aa308423b299a6be6f54ea, b338d91703fae6f6afd67f3f75caa3b8f36ddef3 ≤ v < 55fb52ffdd62850d667ebed842815e072d3c9961, 6.1 | 990e6143b0ca0c66f099d67d00c112bf59b30d76, 2927ff643607eddf4f03d10ef80fe10d977154aa, 7b6b6c077cad0601d62c3c34ab7ce3fb25deda7b, fd62ca5ad136dcf6f5aa308423b299a6be6f54ea, 55fb52ffdd62850d667ebed842815e072d3c9961 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.