CVE-2025-38250: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38250 Overview

CVE-2025-38250 is a use-after-free vulnerability in the Linux kernel Bluetooth subsystem, specifically in the vhci_flush() function within drivers/bluetooth/hci_vhci.c. The flaw was reported by syzbot and stems from missing synchronization between concurrent close() and ioctl() operations on a virtual HCI (vhci) file descriptor. When one thread releases the last file descriptor reference, vhci_release() frees the vhci_data structure while another thread may still be accessing the same hci_dev via hci_dev_reset(). The vulnerability is classified under [CWE-416] Use After Free and affects Linux kernel 6.16 release candidates.

Critical Impact
A local, low-privileged attacker can trigger memory corruption in the kernel through concurrent Bluetooth virtual device operations, potentially leading to privilege escalation or denial of service.

Affected Products

Linux kernel 6.16-rc1
Linux kernel 6.16-rc2
Linux kernel 6.16-rc3

Discovery Timeline

2025-07-09 - CVE-2025-38250 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38250

Vulnerability Analysis

The vulnerability resides in the virtual HCI (vhci) Bluetooth driver used for testing and virtualization. When a userspace process closes a vhci file descriptor, the kernel invokes vhci_release(), which calls hci_unregister_dev(), hci_free_dev(), and kfree() on the vhci_data structure. This structure is stored in hci_dev->dev->driver_data.

The defect is the absence of synchronization after hdev is unlinked from hci_dev_list inside hci_unregister_dev(). A second thread may have already fetched a reference to hdev before the unlink and can continue to access the freed memory through an ioctl() path such as HCIDEVRESET. The KASAN report shows skb_queue_purge_reason+0x99/0x360 reading from freed memory during vhci_flush() after hci_dev_do_reset().

Root Cause

The root cause is a missing read-side synchronization primitive around hci_dev_reset(). The fix introduces Sleepable Read-Copy-Update (SRCU) protection: hci_dev_reset() now runs inside an SRCU read-side critical section, and hci_unregister_dev() waits for outstanding SRCU readers to complete before proceeding to free the device. Without this barrier, the free path and the reset path race, and the reset path dereferences a dangling pointer.

Attack Vector

Exploitation requires local access with the ability to open /dev/vhci and issue socket ioctl() calls against a Bluetooth HCI device. An attacker races two threads: one repeatedly opens and closes the vhci file descriptor while the other issues HCIDEVRESET ioctls on the corresponding HCI device. Winning the race causes vhci_flush() to operate on a freed sk_buff queue, producing a slab use-after-free. Reliable exploitation of kernel UAF conditions can lead to arbitrary kernel memory corruption and local privilege escalation. No public proof-of-concept exists beyond the syzbot reproducer artifacts.

Detection Methods for CVE-2025-38250

Indicators of Compromise

KASAN reports referencing slab-use-after-free in skb_queue_empty_lockless or skb_queue_purge_reason originating from vhci_flush+0x44/0x50
Kernel oops, panic, or general protection fault traces containing hci_dev_do_reset and vhci_flush in the call chain
Unexpected process crashes or kernel warnings on hosts where userspace opens /dev/vhci under load

Detection Strategies

Enable KASAN on test and staging kernels to catch use-after-free conditions in Bluetooth code paths during fuzzing or regression testing
Audit running kernel versions against the fixed commit hashes 0e5c144, 1d61231, bc0819a, and ce23b73 published on git.kernel.org
Monitor for unprivileged local processes opening /dev/vhci and issuing HCIDEVRESET ioctls in rapid succession, which is atypical for production workloads

Monitoring Recommendations

Collect kernel dmesg output and forward oops signatures to a central log store for correlation with process ancestry
Alert on repeated open()/close() cycles against Bluetooth character devices from non-Bluetooth-stack processes
Track kernel version inventory across the fleet to identify hosts still running vulnerable 6.16 release candidate builds

How to Mitigate CVE-2025-38250

Immediate Actions Required

Upgrade to a Linux kernel build that includes the SRCU fix commits 0e5c144c557d, 1d6123102e9f, bc0819a25e04, or ce23b73f0f27 from the stable tree
Restrict access to /dev/vhci to trusted administrative users only, since the attack requires local access to the vhci character device
Unload the hci_vhci module on production systems that do not require virtual Bluetooth functionality

Patch Information

The fix runs hci_dev_reset() under a Sleepable RCU read-side critical section and adds synchronize_srcu() in hci_unregister_dev(). Patches are available on git.kernel.org at Kernel Git Commit 0e5c144, Kernel Git Commit 1d61231, Kernel Git Commit bc0819a, and Kernel Git Commit ce23b73.

Workarounds

Blacklist the hci_vhci module through /etc/modprobe.d/ on hosts that do not run Bluetooth emulation or CI test harnesses
Enforce strict file permissions on /dev/vhci so only root or a dedicated group can open the device
Disable the Bluetooth subsystem entirely on server workloads where wireless connectivity is not required

bash

# Blacklist the vulnerable virtual HCI driver until patched
echo "blacklist hci_vhci" | sudo tee /etc/modprobe.d/blacklist-hci_vhci.conf
sudo rmmod hci_vhci 2>/dev/null

# Verify the running kernel version and confirm the fix is present
uname -r
sudo dmesg | grep -i "Bluetooth: HCI"