CVE-2025-38118: Linux Kernel Bluetooth MGMT UAF Vulnerability

CVE-2025-38118 Overview

CVE-2025-38118 is a use-after-free (UAF) vulnerability [CWE-416] in the Linux kernel's Bluetooth management (MGMT) subsystem. The flaw resides in the mgmt_remove_adv_monitor_complete handler in net/bluetooth/mgmt.c. A local attacker with access to the HCI socket interface can trigger a race between MGMT_OP_REMOVE_ADV_MONITOR command processing and HCI device removal. The pending command structure is freed by mgmt_pending_foreach during index removal while hci_cmd_sync_work still holds a reference, resulting in a slab use-after-free detected by KASAN.

Critical Impact
Successful exploitation can corrupt kernel slab memory and lead to local privilege escalation or denial of service on affected Linux systems.

Affected Products

Linux Kernel (multiple stable branches up to and including 6.16-rc1)
Debian Linux 11.0 (Bullseye)
Distributions shipping the vulnerable Bluetooth MGMT subsystem

Discovery Timeline

2025-07-03 - CVE-2025-38118 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38118

Vulnerability Analysis

The vulnerability affects the Bluetooth Management (MGMT) interface used by userspace tools to control HCI devices. When a client issues the MGMT_OP_REMOVE_ADV_MONITOR opcode, the kernel calls remove_adv_monitor in net/bluetooth/mgmt.c:5454, which invokes mgmt_pending_add to allocate and queue a pending command context via mgmt_pending_new. The completion callback mgmt_remove_adv_monitor_complete later dereferences this context at net/bluetooth/mgmt.c:5406.

A concurrent bind() on an HCI socket can cause hci_sock_bind to trigger mgmt_index_removed, which walks pending commands with mgmt_pending_foreach and frees them via kfree. Because hci_cmd_sync_work executes asynchronously on a workqueue, the completion callback runs against memory already released, producing a slab-use-after-free reachable from an unprivileged local socket.

Root Cause

The root cause is unsafe lifetime management of the pending command object shared between the MGMT command path and the HCI synchronous command worker. The mgmt_pending_add helper does not coordinate with the workqueue that ultimately invokes the completion handler. The upstream fix reworks MGMT_OP_REMOVE_ADV_MONITOR to avoid mgmt_pending_add entirely, eliminating the dangling reference window.

Attack Vector

Exploitation requires local access and the ability to open a Bluetooth HCI socket (AF_BLUETOOTH, BTPROTO_HCI). An attacker races two operations: issuing MGMT_OP_REMOVE_ADV_MONITOR on one socket while calling bind() to trigger index removal on another. Reliable exploitation of use-after-free flaws in the kernel slab allocator can escalate privileges by reclaiming freed memory with attacker-controlled objects. The vulnerability is not remotely exploitable and does not require user interaction.

No public proof-of-concept exploit code is available for CVE-2025-38118. Refer to the upstream commit history for the reference fix.

Detection Methods for CVE-2025-38118

Indicators of Compromise

KASAN reports referencing mgmt_remove_adv_monitor_complete or slab-use-after-free in net/bluetooth/mgmt.c in kernel logs
Unexpected kernel oops or panic entries in dmesg originating from hci_cmd_sync_work
Unprivileged processes opening AF_BLUETOOTH HCI sockets and issuing MGMT opcodes on hardened workstations or servers

Detection Strategies

Enable KASAN on test kernels to surface UAF conditions during QA and fuzzing runs
Audit auditd records for socket(AF_BLUETOOTH, ...) calls followed by rapid bind() and write() sequences from non-Bluetooth-service processes
Correlate kernel crash telemetry with process ancestry to identify local exploitation attempts against the MGMT interface

Monitoring Recommendations

Forward kernel logs and dmesg output to a centralized SIEM and alert on Bluetooth subsystem stack traces
Baseline expected consumers of HCI sockets (for example, bluetoothd) and flag deviations
Track kernel package versions across the fleet and alert on hosts still running vulnerable kernel builds

How to Mitigate CVE-2025-38118

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable kernel commits as distributed by your vendor
Update Debian systems according to the Debian LTS Announcement
Reboot systems after kernel updates to activate patched code paths

Patch Information

The fix reworks MGMT_OP_REMOVE_ADV_MONITOR handling to avoid the mgmt_pending_add lifecycle that caused the dangling reference. The patch is available across multiple stable branches via commits 32aa2fb, 3c9aba9, 9df3e5e, 9f66b65, and e6ed54e. Distribution-specific packages should be obtained from vendor advisories, including the Debian LTS announcement dated October 2025.

Workarounds

Unload the Bluetooth kernel modules (rmmod bluetooth btusb) on systems that do not require Bluetooth functionality
Blacklist the bluetooth module via /etc/modprobe.d/ on servers and headless deployments
Restrict CAP_NET_ADMIN and HCI socket access to trusted service accounts using SELinux or AppArmor policies

bash

# Configuration example
# Disable Bluetooth kernel modules on hosts that do not need Bluetooth
echo "install bluetooth /bin/true" | sudo tee /etc/modprobe.d/disable-bluetooth.conf
sudo systemctl disable --now bluetooth.service
sudo rmmod btusb bluetooth 2>/dev/null || true

# Verify patched kernel is running (example)
uname -r
apt list --installed 2>/dev/null | grep linux-image