CVE-2025-38593

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' Function 'hci_discovery_filter_clear()' frees 'uuids' array and then sets it to NULL. There is a tiny chance of the following race: 'hci_cmd_sync_work()' 'update_passive_scan_sync()' 'hci_update_passive_scan_sync()' 'hci_discovery_filter_clear()' kfree(uuids); <-------------------------preempted--------------------------------> 'start_service_discovery()' 'hci_discovery_filter_clear()' kfree(uuids); // DOUBLE FREE <-------------------------preempted--------------------------------> uuids = NULL; To fix it let's add locking around 'kfree()' call and NULL pointer assignment. Otherwise the following backtrace fires: [ ] ------------[ cut here ]------------ [ ] kernel BUG at mm/slub.c:547! [ ] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP [ ] CPU: 3 UID: 0 PID: 246 Comm: bluetoothd Tainted: G O 6.12.19-kernel #1 [ ] Tainted: [O]=OOT_MODULE [ ] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ ] pc : __slab_free+0xf8/0x348 [ ] lr : __slab_free+0x48/0x348 ... [ ] Call trace: [ ] __slab_free+0xf8/0x348 [ ] kfree+0x164/0x27c [ ] start_service_discovery+0x1d0/0x2c0 [ ] hci_sock_sendmsg+0x518/0x924 [ ] __sock_sendmsg+0x54/0x60 [ ] sock_write_iter+0x98/0xf8 [ ] do_iter_readv_writev+0xe4/0x1c8 [ ] vfs_writev+0x128/0x2b0 [ ] do_writev+0xfc/0x118 [ ] __arm64_sys_writev+0x20/0x2c [ ] invoke_syscall+0x68/0xf0 [ ] el0_svc_common.constprop.0+0x40/0xe0 [ ] do_el0_svc+0x1c/0x28 [ ] el0_svc+0x30/0xd0 [ ] el0t_64_sync_handler+0x100/0x12c [ ] el0t_64_sync+0x194/0x198 [ ] Code: 8b0002e6 eb17031f 54fffbe1 d503201f (d4210000) [ ] ---[ end trace 0000000000000000 ]---

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/16852eccbdfaf41a666705e3f8be55cf2864c5ca
https://git.kernel.org/stable/c/2935e556850e9c94d7a00adf14d3cd7fe406ac03
https://git.kernel.org/stable/c/a351ff6b8ecca4229afaa0d98042bead8de64799
https://git.kernel.org/stable/c/f8069f34c4c976786ded97498012225af87435d7

Configurations

No configuration.

History

19 Aug 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-19 17:15

Updated : 2025-08-19 17:15

NVD link : CVE-2025-38593

Mitre link : CVE-2025-38593

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://git.kernel.org/stable/c/16852eccbdfaf41a666705e3f8be55cf2864c5ca", "name": "https://git.kernel.org/stable/c/16852eccbdfaf41a666705e3f8be55cf2864c5ca", "tags": [], "refsource": ""}, {"url": "https://git.kernel.org/stable/c/2935e556850e9c94d7a00adf14d3cd7fe406ac03", "name": "https://git.kernel.org/stable/c/2935e556850e9c94d7a00adf14d3cd7fe406ac03", "tags": [], "refsource": ""}, {"url": "https://git.kernel.org/stable/c/a351ff6b8ecca4229afaa0d98042bead8de64799", "name": "https://git.kernel.org/stable/c/a351ff6b8ecca4229afaa0d98042bead8de64799", "tags": [], "refsource": ""}, {"url": "https://git.kernel.org/stable/c/f8069f34c4c976786ded97498012225af87435d7", "name": "https://git.kernel.org/stable/c/f8069f34c4c976786ded97498012225af87435d7", "tags": [], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'\n\nFunction 'hci_discovery_filter_clear()' frees 'uuids' array and then\nsets it to NULL. There is a tiny chance of the following race:\n\n'hci_cmd_sync_work()'\n\n 'update_passive_scan_sync()'\n\n 'hci_update_passive_scan_sync()'\n\n 'hci_discovery_filter_clear()'\n kfree(uuids);\n\n <-------------------------preempted-------------------------------->\n 'start_service_discovery()'\n\n 'hci_discovery_filter_clear()'\n kfree(uuids); // DOUBLE FREE\n\n <-------------------------preempted-------------------------------->\n\n uuids = NULL;\n\nTo fix it let's add locking around 'kfree()' call and NULL pointer\nassignment. Otherwise the following backtrace fires:\n\n[ ] ------------[ cut here ]------------\n[ ] kernel BUG at mm/slub.c:547!\n[ ] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\n[ ] CPU: 3 UID: 0 PID: 246 Comm: bluetoothd Tainted: G O 6.12.19-kernel #1\n[ ] Tainted: [O]=OOT_MODULE\n[ ] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ ] pc : __slab_free+0xf8/0x348\n[ ] lr : __slab_free+0x48/0x348\n...\n[ ] Call trace:\n[ ] __slab_free+0xf8/0x348\n[ ] kfree+0x164/0x27c\n[ ] start_service_discovery+0x1d0/0x2c0\n[ ] hci_sock_sendmsg+0x518/0x924\n[ ] __sock_sendmsg+0x54/0x60\n[ ] sock_write_iter+0x98/0xf8\n[ ] do_iter_readv_writev+0xe4/0x1c8\n[ ] vfs_writev+0x128/0x2b0\n[ ] do_writev+0xfc/0x118\n[ ] __arm64_sys_writev+0x20/0x2c\n[ ] invoke_syscall+0x68/0xf0\n[ ] el0_svc_common.constprop.0+0x40/0xe0\n[ ] do_el0_svc+0x1c/0x28\n[ ] el0_svc+0x30/0xd0\n[ ] el0t_64_sync_handler+0x100/0x12c\n[ ] el0t_64_sync+0x194/0x198\n[ ] Code: 8b0002e6 eb17031f 54fffbe1 d503201f (d4210000)\n[ ] ---[ end trace 0000000000000000 ]---"}]}, "problemtype": {"problemtype_data": [{"description": []}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2025-38593", "ASSIGNER": "cve@kernel.org"}}, "impact": {}, "publishedDate": "2025-08-19T17:15Z", "configurations": {"nodes": [], "CVE_data_version": "4.0"}, "lastModifiedDate": "2025-08-19T17:15Z"}