In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
After the hci sync command releases l2cap_conn, the hci receive data work queue references the released l2cap_conn when sending to the upper layer. Add hci dev lock to the hci receive data work queue to synchronize the two.
[1] BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954 Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci1 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline] l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954 l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline] l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817 hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline] hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
Allocated by task 5837: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860 l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726 hci_event_func net/bluetooth/hci_event.c:7473 [inline] hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525 hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 54: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266 hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entr ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-debug-modulesUpgrade kernel-rt-64kUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-modules-extraUpgrade rvUpgrade kernel-rt-64k-modules-coreUpgrade kernel-develUpgrade kernel-rtUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-modules-extraUpgrade kernel-64k-modules-extraUpgrade kernel-uki-virtUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-develUpgrade kernel-toolsUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-64k-debug-modules-coreUpgrade kernel-docUpgrade kernel-rt-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-64k-debug-develUpgrade perfUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-64k-develUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-debugUpgrade kernel-64k-coreUpgrade kernel-64k-develUpgrade kernel-cross-headersUpgrade kernel-debug-uki-virtUpgrade kernel-tools-libsUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-coreUpgrade kernel-coreUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-64k-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-rt-modules-extraUpgrade rtlaUpgrade kernel-modules-extraUpgrade kernel-headersUpgrade kernel-debug-coreUpgrade kernel-modules-coreUpgrade kernel-devel-matchedUpgrade kernelUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-modulesUpgrade kernel-debug-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-64kUpgrade kernel-64k-debug-coreUpgrade kernel-rt-64k-debugUpgrade python3-perfUpgrade kernel-debug-develUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-64k-modules-extraUpgrade libperfUpgrade kernel-64k-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-abi-stablelists | Jul 4, 2025 | Apr 1, 2025 |
| Debian | — | Upgrade linux | May 15, 2025 | Apr 1, 2025 |
| Oracle_linux | — | Upgrade kernel | Jun 30, 2025 | Apr 1, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Jun 17, 2025 | Apr 1, 2025 |
| Rocky_linux | — | Upgrade kernel-debug-modules-coreUpgrade kernel-headersUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-debug-debuginfoUpgrade kernel-debug-devel-matchedUpgrade kernel-cross-headersUpgrade kernel-debug-modules-extraUpgrade python3-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernelUpgrade kernel-rt-modules-extraUpgrade kernel-debuginfo-common-s390xUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-develUpgrade libperf-debuginfoUpgrade kernel-debug-coreUpgrade kernel-modules-coreUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-tools-libsUpgrade rtlaUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rtUpgrade kernel-develUpgrade kernel-coreUpgrade python3-perfUpgrade libperfUpgrade kernel-rt-develUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debugUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-coreUpgrade kernel-rt-modulesUpgrade kernel-debugUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modules-coreUpgrade perfUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade kernel-rt-kvmUpgrade rvUpgrade kernel-uki-virt-addonsUpgrade perf-debuginfoUpgrade kernel-uki-virtUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-devel-matched | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade cluster-md-kmp-azureUpgrade dtb-amazonUpgrade kernel-default-extraUpgrade kernel-macrosUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-rtUpgrade cluster-md-kmp-rtUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-default-base-rebuildUpgrade kernel-kvmsmall-develUpgrade dtb-xilinxUpgrade kernel-rt-develUpgrade kernel-rt-optionalUpgrade kernel-syms-azureUpgrade kernel-default-vdsoUpgrade kernel-rt_debug-develUpgrade dtb-mediatekUpgrade kernel-rtUpgrade dtb-exynosUpgrade gfs2-kmp-azureUpgrade kernel-rt-vdsoUpgrade kernel-source-azureUpgrade dtb-amlogicUpgrade dtb-caviumUpgrade ocfs2-kmp-64kbUpgrade kernel-devel-azureUpgrade kernel-develUpgrade kernel-azure-develUpgrade gfs2-kmp-64kbUpgrade kernel-default-develUpgrade kselftests-kmp-64kbUpgrade dtb-lgUpgrade kernel-64kbUpgrade dtb-alteraUpgrade kernel-obs-qaUpgrade kernel-preemptUpgrade ocfs2-kmp-defaultUpgrade kernel-symsUpgrade dtb-allwinnerUpgrade dtb-qcomUpgrade kernel-zfcpdumpUpgrade kernel-default-optionalUpgrade kernel-default-livepatchUpgrade kernel-devel-rtUpgrade gfs2-kmp-rtUpgrade dtb-apmUpgrade kernel-sourceUpgrade kernel-source-rtUpgrade dtb-freescaleUpgrade kselftests-kmp-azureUpgrade dtb-rockchipUpgrade dtb-marvellUpgrade dtb-broadcomUpgrade kernel-default-manUpgrade kernel-debugUpgrade kernel-rt-livepatch-develUpgrade kernel-obs-buildUpgrade dlm-kmp-rtUpgrade kernel-azure-extraUpgrade kernel-64kb-develUpgrade dtb-renesasUpgrade kernel-syms-rtUpgrade kernel-rt_debugUpgrade dtb-socionextUpgrade kernel-rt_debug-vdsoUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-defaultUpgrade dtb-amdUpgrade kselftests-kmp-defaultUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-docsUpgrade dlm-kmp-defaultUpgrade kernel-azure-vdsoUpgrade kernel-debug-develUpgrade kernel-preempt-develUpgrade kernel-default-baseUpgrade reiserfs-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-rt-extraUpgrade kernel-default-livepatch-develUpgrade kernel-azureUpgrade kernel-64kb-extraUpgrade kernel-defaultUpgrade kernel-debug-vdsoUpgrade dtb-sprdUpgrade dtb-armUpgrade dtb-appleUpgrade dtb-hisiliconUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-rtUpgrade dtb-nvidia | Dec 5, 2025 | Jun 19, 2025 |
| Ubuntu | — | Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1039-nvidia-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-raspiUpgrade linux-image-gkeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-azure-6.8Upgrade linux-image-6.11.0-1015-awsUpgrade linux-image-gkeopUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-2031-raspi-realtimeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-gke-64k-6.8Upgrade linux-image-6.8.0-1036-gke-64kUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-6.8.0-85-genericUpgrade linux-image-generic-64kUpgrade linux-image-oem-22.04Upgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-genericUpgrade linux-image-oracleUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-84-lowlatencyUpgrade linux-image-6.8.0-1037-oracle-64kUpgrade linux-image-raspi-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1036-gkeUpgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-1039-nvidiaUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-1036-azure-fdeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-virtual-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-aws-64kUpgrade linux-image-6.8.0-85-generic-64kUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-6.8.0-84-lowlatency-64kUpgrade linux-image-lowlatency-6.8Upgrade linux-image-oracle-6.8Upgrade linux-image-lowlatency-64kUpgrade linux-image-azure-fde-6.8Upgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-84-generic-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-realtimeUpgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-1039-nvidia-lowlatencyUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1040-gcp-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-1038-azure-fdeUpgrade linux-image-gcp-6.8Upgrade linux-image-azure-nvidiaUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-nvidiaUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1039-awsUpgrade linux-image-gke-64kUpgrade linux-image-gcpUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-oracle-64kUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-1039-aws-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-kvmUpgrade linux-image-virtualUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-1039-raspiUpgrade linux-image-lowlatencyUpgrade linux-image-azure-fde-edgeUpgrade linux-image-nvidia-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1023-gkeopUpgrade linux-image-generic-6.8Upgrade linux-image-oem-22.04bUpgrade linux-image-ibm-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-6.8.0-84-genericUpgrade linux-image-6.11.0-28-genericUpgrade linux-image-azure-fdeUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-6.11.0-1018-azureUpgrade linux-image-ibmUpgrade linux-image-lowlatency-6.11Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-6.8.0-1025-azure-nvidiaUpgrade linux-image-azure-fde-6.11Upgrade linux-image-6.8.0-1039-nvidia-lowlatency-64kUpgrade linux-image-6.8.1-1034-realtimeUpgrade linux-image-azure-6.11Upgrade linux-image-6.8.0-1040-gcpUpgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-6.8.0-1038-azureUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-6.8.0-1037-oracleUpgrade linux-image-aws-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-ibm-classicUpgrade linux-image-azure-nvidia-6.8Upgrade linux-image-awsUpgrade linux-image-gkeop-6.8Upgrade linux-image-azureUpgrade linux-image-6.8.0-1036-azureUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1037-ibmUpgrade linux-image-azure-nvidia-lts-24.04 | Jun 26, 2025 | Apr 1, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub