CVE-2025-40318
High
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF". Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Linux
PublishedDec 8, 2025
First seenDec 8, 2025
How to fix
Update
- Linux Linux0a94f7e017438935c09ef833a1aa908ad9875213, 932c0a4f77ac13e526fdd5b42914d29c9821d389, ae76cf6c2c842944c6514c57df54d728f1916553, 9cd536970192b72257afcdfba0bfc09993e6f19c, 09b0cd1297b4dbfe736aeaa0ceeab2265f47f772, 6.1.159, 6.6.117, 6.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | f00f36db76eb8fd10d13e80e2590f23b5beaa54d ≤ v < 0a94f7e017438935c09ef833a1aa908ad9875213, 1499f79995c7ee58e3bfeeff75f6d1b37dcda881 ≤ v < 932c0a4f77ac13e526fdd5b42914d29c9821d389, 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 ≤ v < ae76cf6c2c842944c6514c57df54d728f1916553, 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 ≤ v < 9cd536970192b72257afcdfba0bfc09993e6f19c, 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 ≤ v < 09b0cd1297b4dbfe736aeaa0ceeab2265f47f772, 357603f4d396d85fbf0045512efaf1d7f7394ed7, 6.1.120 ≤ v < 6.1.159, 6.6.51 ≤ v < 6.6.117, 6.8.9 ≤ v < 6.9, 6.9 | 0a94f7e017438935c09ef833a1aa908ad9875213, 932c0a4f77ac13e526fdd5b42914d29c9821d389, ae76cf6c2c842944c6514c57df54d728f1916553, 9cd536970192b72257afcdfba0bfc09993e6f19c, 09b0cd1297b4dbfe736aeaa0ceeab2265f47f772, 6.1.159, 6.6.117, 6.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.