CVE-2025-40283 json
Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
published 11mo ago modified 25d ago also EUVD-2025-201572
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 4%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
There is a KASAN: slab-use-after-free read in btusb_disconnect(). Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will free the btusb data associated with the interface. The same data is then used later in the function, hence the UAF.
Fix by moving the accesses to btusb data to before the data is free'd.
Patch / fix
- Linux Linux 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.59, 6.17.9, 6.18
- linux Debian 12 6.1.159-1
- linux Debian 13 6.12.63-1
- linux Debian 14 6.17.9-1
debian advisories DEBIAN-CVE-2025-40283
- linux Ubuntu 22.04 LTS 5.15.0-173.183
- linux Ubuntu 24.04 LTS 6.8.0-106.106
- linux Ubuntu 25.10 6.17.0-14.14
- linux-aws Ubuntu 22.04 LTS 5.15.0-1103.110
- linux-aws Ubuntu 24.04 LTS 6.8.0-1050.53
- linux-aws Ubuntu 25.10 6.17.0-1007.7
- linux-gcp Ubuntu 22.04 LTS 5.15.0-1103.112
- linux-gcp Ubuntu 24.04 LTS 6.8.0-1052.55
ubuntu advisories UBUNTU-CVE-2025-40283
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-40.1
- kernel-source-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-40.1
- kernel-source Linux Micro 6.1, Linux Micro 6.0 6.4.0-39.1
- kernel-default Linux Micro 6.1, Linux Micro 6.0 6.4.0-39.1
- kernel-kvmsmall Linux Micro 6.1, Linux Micro 6.0 6.4.0-39.1
- kernel-default-base Linux Micro 6.1, Linux Micro 6.0 6.4.0-39.1.21.16
- kernel-rt Linux Micro 6.2 6.12.0-160000.9.1
- kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.9.1
suse advisories SUSE-SU-2026:20845-1SUSE-SU-2026:20876-1SUSE-SU-2026:20477-1SUSE-SU-2026:20498-1SUSE-SU-2026:20207-1SUSE-SU-2026:20220-1
- kernel-rt openSUSE Leap 16.0 6.12.0-160000.9.1
- dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.9.1
- kernel-64kb openSUSE Leap 16.0 6.12.0-160000.9.1
- kernel-syms openSUSE Leap 16.0 6.12.0-160000.9.1
- kernel-azure openSUSE Leap 16.0 6.12.0-160000.9.1
- kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.9.1
- kernel-source openSUSE Leap 16.0 6.12.0-160000.9.1
- kernel-default openSUSE Leap 16.0 6.12.0-160000.9.1
opensuse advisories openSUSE-SU-2026:20145-1
- git.kernel.org/stable/c/297dbf87989e09af98f81f2bcb938041785557e8 commit
- git.kernel.org/stable/c/f858f004bc343a7ae9f2533bbb2a3ab27428532f commit
- git.kernel.org/stable/c/7a6d1e740220ff9dfcb6a8c994d6ba49e76db198 commit
- git.kernel.org/stable/c/5dc00065a0496c36694afe11e52a5bc64524a9b8 commit
- git.kernel.org/stable/c/1c28c1e1522c773a94e26950ffb145e88cd9834b commit
- git.kernel.org/stable/c/95b9b98c93b1c0916a3d4cf4540b7f5d69145a0d commit
- git.kernel.org/stable/c/a2610ecd9fd5708be8997ca8f033e4200c0bb6af commit
- git.kernel.org/stable/c/23d22f2f71768034d6ef86168213843fc49bf550 commit
Is CVE-2025-40283 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-40283 updated cvss 5.5
kernel: Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 moreaffected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernelaffected: no fix available “Fix deferred”
-
Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 25d ago
Exploit prediction
0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Linux Linux
Classification
- Technology feeds
References
- git.kernel.org /stable/c/297dbf87989e09af98f81f2bcb938041785557e8
- git.kernel.org /stable/c/f858f004bc343a7ae9f2533bbb2a3ab27428532f
- git.kernel.org /stable/c/7a6d1e740220ff9dfcb6a8c994d6ba49e76db198
- git.kernel.org /stable/c/5dc00065a0496c36694afe11e52a5bc64524a9b8
- git.kernel.org /stable/c/1c28c1e1522c773a94e26950ffb145e88cd9834b
- git.kernel.org /stable/c/95b9b98c93b1c0916a3d4cf4540b7f5d69145a0d
- git.kernel.org /stable/c/a2610ecd9fd5708be8997ca8f033e4200c0bb6af
- git.kernel.org /stable/c/23d22f2f71768034d6ef86168213843fc49bf550
Sources
- CVE List CVE-2025-40283
- NVD CVE-2025-40283
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.