Skip to content
Fencer Vulns
high 8.8

CVE-2025-21969 json

Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd

published 2025-04-01 19 mo ago modified 2026-10-30 10 d ago also EUVD-2025-9351

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd

After the hci sync command releases l2cap_conn, the hci receive data work queue references the released l2cap_conn when sending to the upper layer. Add hci dev lock to the hci receive data work queue to synchronize the two.

[1] BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954 Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837

CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci1 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline] l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954 l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline] l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817 hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline] hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>

Allocated by task 5837: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860 l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726 hci_event_func net/bluetooth/hci_event.c:7473 [inline] hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525 hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 54: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266 hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entr ---truncated---

Patch / fix

  • Linux Linux 5.18, 6.1.191, 6.6.84, 6.12.20, 6.13.8, 6.14
  • linux Debian 14, Debian 13 6.12.20-1

debian advisories DEBIAN-CVE-2025-21969

  • linux Ubuntu 24.04 LTS 6.8.0-84.84
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1039.41
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1040.42
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1036.40
  • linux-ibm Ubuntu 24.04 LTS 6.8.0-1037.37
  • linux-azure Ubuntu 24.04 LTS 6.8.0-1038.44
  • linux-gkeop Ubuntu 24.04 LTS 6.8.0-1023.25
  • linux-raspi Ubuntu 24.04 LTS 6.8.0-1039.43

ubuntu advisories UBUNTU-CVE-2025-21969

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 9 5.14.0-570.22.1.el9_6
  • rv RHEL 9 5.14.0-570.22.1.el9_6
  • perf RHEL 9 5.14.0-570.22.1.el9_6
  • rtla RHEL 9 5.14.0-570.22.1.el9_6
  • libperf RHEL 9 5.14.0-570.22.1.el9_6
  • kernel-rt RHEL 9 5.14.0-570.22.1.el9_6
  • kernel-64k RHEL 9 5.14.0-570.22.1.el9_6
  • kernel-core RHEL 9 5.14.0-570.22.1.el9_6

red hat advisories RHSA-2025:9080RHSA-2025:9079

  • kernel-64kb SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS, Enterprise Storage 7.1 5.3.18-150300.59.221.1
  • kernel-syms SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 5.3.18-150300.59.221.1
  • kernel-source SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 5.3.18-150300.59.221.1
  • kernel-default SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +5 more 5.3.18-150300.59.221.1
  • kernel-preempt SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 5.3.18-150300.59.221.1
  • kernel-obs-build SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 5.3.18-150300.59.221.1
  • kernel-default-base SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +3 more 5.3.18-150300.59.221.1.150300.18.132.1
  • kernel-rt SLE Micro 5.2, SLE Micro 5.1 5.3.18-150300.223.1

suse advisories SUSE-SU-2025:03626-1SUSE-SU-2025:03613-1SUSE-SU-2025:01983-1SUSE-SU-2025:01967-1SUSE-SU-2025:01964-1SUSE-SU-2025:01951-1

  • kernel AlmaLinux 9 5.14.0-570.22.1.el9_6
  • rv AlmaLinux 9 5.14.0-570.22.1.el9_6
  • perf AlmaLinux 9 5.14.0-570.22.1.el9_6
  • rtla AlmaLinux 9 5.14.0-570.22.1.el9_6
  • libperf AlmaLinux 9 5.14.0-570.22.1.el9_6
  • kernel-rt AlmaLinux 9 5.14.0-570.22.1.el9_6
  • kernel-64k AlmaLinux 9 5.14.0-570.22.1.el9_6
  • kernel-core AlmaLinux 9 5.14.0-570.22.1.el9_6

almalinux advisories ALSA-2025:9080

  • kernel Rocky Linux 10 6.12.0-55.17.1.el10_0

rocky linux advisories RLSA-2025:9079

  • kernel Azure Linux 3.0 6.6.85.1-2

azure linux advisories AZL-60270

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-21969 updated cvss 7.1

kernel: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd

  • Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-570.22.1.el9_6, perf 5.14.0-570.22.1.el9_6, rtla 5.14.0-570.22.1.el9_6, python3-perf 5.14.0-570.22.1.el9_6, kernel-devel-matched 5.14.0-570.22.1.el9_6, kernel-64k-devel-matched 5.14.0-570.22.1.el9_6, +7 more
    fixed: vendor fix RHSA-2025:9080
  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-55.17.1.el10_0, perf 6.12.0-55.17.1.el10_0, rtla 6.12.0-55.17.1.el10_0, python3-perf 6.12.0-55.17.1.el10_0, kernel-devel-matched 6.12.0-55.17.1.el10_0, kernel-64k-devel-matched 6.12.0-55.17.1.el10_0, +7 more
    fixed: vendor fix RHSA-2025:9079
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-570.22.1.el9_6, kernel-64k 5.14.0-570.22.1.el9_6, kernel-core 5.14.0-570.22.1.el9_6, kernel-tools 5.14.0-570.22.1.el9_6, kernel-modules 5.14.0-570.22.1.el9_6, kernel-64k-core 5.14.0-570.22.1.el9_6, +27 more
    fixed: vendor fix RHSA-2025:9080
  • Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-55.17.1.el10_0, kernel-64k 6.12.0-55.17.1.el10_0, kernel-core 6.12.0-55.17.1.el10_0, kernel-tools 6.12.0-55.17.1.el10_0, kernel-modules 6.12.0-55.17.1.el10_0, kernel-64k-core 6.12.0-55.17.1.el10_0, +27 more
    fixed: vendor fix RHSA-2025:9079
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-570.22.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.22.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.22.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.22.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.22.1.el9_6
    fixed: vendor fix RHSA-2025:9080
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-55.17.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.17.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.17.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.17.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.17.1.el10_0
    fixed: vendor fix RHSA-2025:9079
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-570.22.1.el9_6, kernel-rt-64k 5.14.0-570.22.1.el9_6, kernel-rt-core 5.14.0-570.22.1.el9_6, kernel-rt-modules 5.14.0-570.22.1.el9_6, kernel-rt-64k-core 5.14.0-570.22.1.el9_6, kernel-rt-debug-core 5.14.0-570.22.1.el9_6, +14 more
    fixed: vendor fix RHSA-2025:9080
show 4 more
  • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-55.17.1.el10_0, kernel-rt-64k 6.12.0-55.17.1.el10_0, kernel-rt-core 6.12.0-55.17.1.el10_0, kernel-rt-modules 6.12.0-55.17.1.el10_0, kernel-rt-64k-core 6.12.0-55.17.1.el10_0, kernel-rt-debug-core 6.12.0-55.17.1.el10_0, +14 more
    fixed: vendor fix RHSA-2025:9079
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-570.22.1.el9_6, kernel-rt-kvm 5.14.0-570.22.1.el9_6, kernel-rt-core 5.14.0-570.22.1.el9_6, kernel-rt-modules 5.14.0-570.22.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.22.1.el9_6, kernel-rt-debug-core 5.14.0-570.22.1.el9_6, +6 more
    fixed: vendor fix RHSA-2025:9080
  • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-55.17.1.el10_0, kernel-rt-kvm 6.12.0-55.17.1.el10_0, kernel-rt-core 6.12.0-55.17.1.el10_0, kernel-rt-modules 6.12.0-55.17.1.el10_0, kernel-rt-debug-kvm 6.12.0-55.17.1.el10_0, kernel-rt-debug-core 6.12.0-55.17.1.el10_0, +6 more
    fixed: vendor fix RHSA-2025:9079
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
13 mo ago

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.