CVE-2025-71082: Linux Kernel Use-After-Free Vulnerability

CVE-2025-71082 Overview

CVE-2025-71082 is a use-after-free vulnerability in the Linux kernel's Bluetooth USB driver (btusb). The flaw originates from the use of devm_kzalloc() in btusb_probe() to allocate driver data. This allocation ties the lifetime of all btusb data to a single interface binding, which causes premature memory release when the driver binds to multiple interfaces such as INTF, ISOC, and DIAG. The issue surfaces in btusb_disconnect(), where usb_driver_release_interface() triggers devm to free data still in use by other interfaces. The fix reverts commit 98921dbd00c4e and restores explicit memory management.

Critical Impact
A local attacker with the ability to trigger Bluetooth USB device disconnect events can exploit freed kernel memory to achieve privilege escalation, code execution, or system compromise.

Affected Products

Linux Kernel version 3.7 and later (prior to fix)
Linux Kernel 6.19-rc1 through 6.19-rc8
Systems using the btusb Bluetooth USB driver

Discovery Timeline

2026-01-13 - CVE-2025-71082 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2025-71082

Vulnerability Analysis

The vulnerability resides in the btusb Bluetooth USB driver in the Linux kernel. The driver binds to multiple USB interfaces on a single Bluetooth controller, including the main interface (INTF), the isochronous interface (ISOC), and the diagnostic interface (DIAG). All these interfaces share a common btusb_data structure that holds driver state.

The original commit 98921dbd00c4e replaced explicit kzalloc() allocation with devm_kzalloc() to simplify resource cleanup. However, devm_* managed allocations are tied to the lifetime of a single device binding. When the driver unbinds from the primary interface, the managed allocation is freed automatically, even while other interfaces still reference the same memory.

Root Cause

The root cause is improper memory lifetime management [CWE-416 Use After Free]. The devm_kzalloc() API associates the allocated buffer with a single struct device, but the btusb driver shares this buffer across multiple interface bindings. When btusb_disconnect() calls usb_driver_release_interface(&btusb_driver, data->intf), the devm framework releases the buffer prematurely while other interface contexts continue to dereference it.

Attack Vector

Exploitation requires local access with the ability to trigger Bluetooth USB device probe and disconnect sequences. An attacker can induce the use-after-free condition by manipulating USB device states, physically attaching and detaching a Bluetooth controller, or invoking driver unbind operations through sysfs. Successful exploitation can lead to kernel memory corruption, information disclosure, or arbitrary code execution at ring 0.

The vulnerability mechanism is described in detail in the upstream kernel commits. Refer to Kernel Commit fff9206 for the patch implementation.

Detection Methods for CVE-2025-71082

Indicators of Compromise

Kernel oops or panic messages referencing btusb_disconnect or btusb_probe in dmesg output
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the btusb driver
Unexpected Bluetooth subsystem crashes during device hotplug events
Memory corruption signatures in kernel ring buffer logs following USB disconnect events

Detection Strategies

Audit running kernel versions against the fixed commits across the 5.x, 6.x, and 6.19-rc stable trees
Enable KASAN on test systems to validate exposure to the use-after-free condition
Monitor kernel logs for btusb subsystem warnings, especially during USB unbind operations
Correlate Bluetooth driver crash events with privilege escalation attempts on the same host

Monitoring Recommendations

Centralize kernel log collection and alert on Oops, BUG, or KASAN strings tied to btusb
Track USB device attach and detach events on systems exposing Bluetooth adapters
Apply behavioral monitoring for unexpected kernel module load and unload activity

How to Mitigate CVE-2025-71082

Immediate Actions Required

Inventory all Linux hosts running affected kernel versions and prioritize systems with active Bluetooth USB hardware
Apply vendor-supplied kernel updates that incorporate the upstream fix
Restrict physical access to systems with exposed USB ports, particularly servers and shared workstations
Disable the btusb module on systems that do not require Bluetooth functionality using modprobe.blacklist

Patch Information

The fix reverts the use of devm_kzalloc() and reinstates explicit kfree() cleanup. Patches are available in the upstream Linux stable trees. Reference the following kernel commits: Kernel Commit 1e54c19, Kernel Commit 252714f, Kernel Commit c0ecb3e, Kernel Commit cca0e92, Kernel Commit fdf7c64, and Kernel Commit fff9206.

Workarounds

Blacklist the btusb kernel module on systems where Bluetooth is not operationally required
Physically remove or disable Bluetooth USB controllers via firmware settings
Restrict local user access and enforce least-privilege policies to limit attackers' ability to trigger USB driver state transitions

bash

# Configuration example: blacklist btusb module until patched
echo "blacklist btusb" | sudo tee /etc/modprobe.d/blacklist-btusb.conf
sudo rmmod btusb 2>/dev/null || true
sudo update-initramfs -u