CVE-2025-39861: Linux Kernel Bluetooth Use-After-Free Vulnerability

CVE-2025-39861 Overview

CVE-2025-39861 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Bluetooth Virtual HCI (vhci) driver. The flaw exists because debugfs files created by the vhci driver were not explicitly removed during vhci_release(). When vhci_release() freed the backing vhci_data structure, the debugfs entries such as force_suspend and force_wakeup remained accessible through hdev->debugfs until hci_release_dev() cleaned them up later. A local user with access to those debugfs files could read or write them after the underlying data structure had been freed.

Critical Impact
A local, authenticated user can trigger a use-after-free in the Linux kernel Bluetooth vhci driver, potentially leading to memory corruption, privilege escalation, or a kernel crash.

Affected Products

Linux kernel (multiple stable branches prior to the fix commits)
Linux kernel 6.17-rc1, 6.17-rc2, 6.17-rc3, 6.17-rc4
Distributions shipping unpatched kernels with the Bluetooth vhci driver enabled

Discovery Timeline

2025-09-19 - CVE-2025-39861 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39861

Vulnerability Analysis

The Linux kernel Bluetooth virtual HCI driver exposes several debugfs interfaces used for testing and emulation, including force_suspend, force_wakeup, and related toggles. These files are created under hdev->debugfs and are backed by the private vhci_data structure allocated per device.

The original implementation created these debugfs files inline but never removed them in vhci_release(). When user space closed the /dev/vhci character device, vhci_release() freed the associated vhci_data. However, the debugfs entries continued to reference that freed memory. The debugfs directory is only torn down later inside hci_release_dev(), leaving a window in which another process can open and operate on the stale files.

An attacker with local access and permission to read the affected debugfs paths can trigger dereferences of freed kernel memory. Successful exploitation can corrupt kernel heap state, leak sensitive data, or hijack control flow.

Root Cause

The root cause is a lifetime mismatch between the debugfs file handles and the vhci_data allocation that backs them. The driver freed the private data in vhci_release() without invoking debugfs_remove() on the files it had registered, leaving dangling references [CWE-416].

Attack Vector

Exploitation requires local access on a system where the vhci driver is loaded and its debugfs entries are reachable by the attacker. The attacker opens one of the exposed debugfs files (for example force_suspend) and races the release path of the associated /dev/vhci handle. Reads or writes issued after vhci_release() completes but before hci_release_dev() finishes touch freed memory.

No network access, user interaction, or elevated privilege beyond local debugfs access is required. The vulnerability manifests entirely inside the kernel, so successful memory corruption can be leveraged toward local privilege escalation. Refer to the upstream Linux kernel commits linked in the vendor advisory section for the exact source-level changes.

Detection Methods for CVE-2025-39861

Indicators of Compromise

Kernel oops, general protection fault, or KASAN: use-after-free messages referencing vhci_ symbols or Bluetooth HCI functions in dmesg.
Unexpected process activity opening files under /sys/kernel/debug/bluetooth/hci*/ shortly before or after /dev/vhci file descriptors are closed.
Kernel panics originating from debugfs read or write handlers tied to the Bluetooth vhci driver.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and pre-production kernels to surface use-after-free conditions in the vhci code path.
Audit running kernel versions across the fleet and compare against the fixed commit hashes: 1503756f, 28010791, 7cc08f2f, and bd75eba8.
Use auditd rules to log opens of debugfs paths owned by the Bluetooth subsystem by unprivileged users.

Monitoring Recommendations

Forward kernel logs to a central telemetry platform and alert on repeated vhci-related faults or KASAN reports.
Track processes that interact with /dev/vhci alongside their subsequent debugfs access to detect suspicious race attempts.
Monitor loaded kernel modules and flag hosts where the hci_vhci module is present on systems that do not require Bluetooth emulation.

How to Mitigate CVE-2025-39861

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the vendor advisory links and reboot affected hosts.
On systems that do not need Bluetooth virtualization, unload the hci_vhci module with modprobe -r hci_vhci and blacklist it.
Restrict access to /dev/vhci and the Bluetooth debugfs tree to root only, and mount debugfs with mode=0700 where operationally acceptable.

Patch Information

The fix moves debugfs file creation into a dedicated helper and explicitly calls debugfs_remove() for each file in vhci_release() before freeing vhci_data. Merged upstream commits: Kernel Git Commit 1503756f, Kernel Git Commit 28010791, Kernel Git Commit 7cc08f2f, and Kernel Git Commit bd75eba8. Consume the fix through your distribution's stable kernel update once it is packaged.

Workarounds

Blacklist the hci_vhci kernel module on systems that do not require Bluetooth HCI emulation.
Remount debugfs with restricted permissions, for example mount -o remount,mode=0700 /sys/kernel/debug, to block non-root users from reaching the vulnerable files.
Use kernel lockdown or CONFIG_DEBUG_FS_ALLOW_NONE in hardened builds to disable debugfs entirely where feasible.

bash

# Blacklist the vulnerable module and restrict debugfs access
echo 'blacklist hci_vhci' | sudo tee /etc/modprobe.d/blacklist-vhci.conf
sudo modprobe -r hci_vhci
sudo mount -o remount,mode=0700 /sys/kernel/debug