CVE-2025-38593 Overview
CVE-2025-38593 is a double free vulnerability [CWE-415] in the Linux kernel's Bluetooth subsystem, specifically within the hci_sync module. The flaw resides in the hci_discovery_filter_clear() function, which frees the uuids array before setting the pointer to NULL. A race condition between hci_cmd_sync_work() and start_service_discovery() allows two concurrent invocations to call kfree() on the same memory region, triggering a kernel BUG at mm/slub.c:547. The vulnerability affects multiple Linux kernel versions and requires local access with low privileges to exploit.
Critical Impact
Successful exploitation triggers kernel memory corruption leading to denial of service or potential local privilege escalation on affected Linux systems running Bluetooth services.
Affected Products
- Linux Kernel (multiple stable branches prior to patch commits)
- Systems running bluetoothd with active Bluetooth service discovery
- Distributions shipping affected kernel versions with the hci_sync module
Discovery Timeline
- 2025-08-19 - CVE-2025-38593 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2025-38593
Vulnerability Analysis
The vulnerability exists in the Bluetooth Host Controller Interface (HCI) synchronization code path in the Linux kernel. The hci_discovery_filter_clear() function is responsible for releasing the uuids array associated with a discovery filter and then nullifying the pointer. The two operations, however, are not atomic and are unprotected by any lock.
When hci_cmd_sync_work() invokes update_passive_scan_sync() and reaches hci_discovery_filter_clear(), the kernel calls kfree(uuids). If preemption occurs between the kfree() call and the subsequent uuids = NULL assignment, a userspace-initiated start_service_discovery() request can enter the same hci_discovery_filter_clear() function and call kfree() on the already-freed pointer. This results in a double free that the SLUB allocator detects, triggering a kernel BUG.
Root Cause
The root cause is missing synchronization between the memory deallocation and the pointer nullification in hci_discovery_filter_clear(). Without a lock protecting both operations as a single critical section, concurrent execution paths can observe a stale non-NULL pointer to freed memory. The fix wraps the kfree() call and NULL assignment in appropriate locking to prevent the race.
Attack Vector
Exploitation requires a local, low-privileged user account with the ability to interact with the Bluetooth socket interface (typically via hci_sock_sendmsg). An attacker triggers concurrent service discovery operations while the kernel is performing passive scan updates. The bluetoothd daemon and preemptive scheduling create the timing window required for the race. The observed kernel backtrace confirms exploitation is reachable through the standard writev syscall path against a Bluetooth HCI socket.
No public proof-of-concept is available at time of publication.
Detection Methods for CVE-2025-38593
Indicators of Compromise
- Kernel panic or Oops messages referencing __slab_free, kfree, and start_service_discovery in dmesg or /var/log/kern.log
- Unexpected bluetoothd process crashes correlated with kernel BUG traces at mm/slub.c:547
- Repeated Bluetooth discovery requests originating from non-standard user processes
Detection Strategies
- Monitor kernel ring buffer for SLUB allocator BUG messages indicating double free conditions in the Bluetooth subsystem
- Audit processes invoking writev against Bluetooth HCI sockets, particularly those triggering rapid successive service discovery operations
- Track kernel version and patch status across the fleet to identify hosts running vulnerable builds
Monitoring Recommendations
- Enable kernel crash dumps (kdump) to capture full context of any SLUB double free events for forensic analysis
- Ingest /var/log/kern.log and journalctl output into a centralized log platform and alert on slub.c BUG signatures
- Correlate Bluetooth daemon restarts with concurrent local user activity to detect potential exploitation attempts
How to Mitigate CVE-2025-38593
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the vendor advisories and reboot affected systems
- Restrict access to Bluetooth HCI sockets to trusted users only by tightening CAP_NET_ADMIN and CAP_NET_RAW assignments
- Disable the Bluetooth subsystem on servers and workstations that do not require it by unloading the bluetooth kernel module
Patch Information
The fix is available in the mainline kernel and stable branches through commits 16852ecc, 2935e556, 7ce9bb0b, a351ff6b, and f8069f34. The patch introduces locking around the kfree() call and NULL pointer assignment inside hci_discovery_filter_clear(). Refer to the technical commit reference for the full source change.
Workarounds
- Blacklist the bluetooth, btusb, and related modules on systems where Bluetooth functionality is not required
- Stop and disable the bluetooth.service unit via systemctl disable --now bluetooth to prevent bluetoothd from initiating discovery operations
- Limit local access on multi-user systems and enforce principle of least privilege to reduce the pool of accounts capable of triggering the race
# Configuration example: disable Bluetooth to mitigate CVE-2025-38593
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb' | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
