CVE-2025-40318 Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
A race condition in the Linux kernel Bluetooth subsystem allows concurrent access leading to use-after-free, potentially enabling code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40318?
CVE-2025-40318 is a high-severity vulnerability in Linux, published on 8 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF".
Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.
Which versions are affected by CVE-2025-40318?
How do I fix CVE-2025-40318?
Apply the vendor's patch.
Is CVE-2025-40318 being exploited?
There is no known exploitation of CVE-2025-40318 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40318, DEBIAN-CVE-2025-40318, GHSA-m8vr-v3r8-7vqf, ROOT-OS-DEBIAN-12-CVE-2025-40318, ROOT-OS-DEBIAN-13-CVE-2025-40318, ROOT-OS-UBUNTU-2404-CVE-2025-40318 and 1 more.