CVE-2025-68305 in Linux
Summary
by MITRE • 12/16/2025
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending before write iter sends the cmd, just as syzbot reported in UAF[1].
Here we use hci_dev_lock to synchronize the two, thereby avoiding the UAF mentioned in [1].
[1]
syzbot reported: BUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 Read of size 8 at addr ffff888077164818 by task syz.0.17/5989 Call Trace: mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195
Allocated by task 5989: mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296 set_link_security+0x557/0x710 net/bluetooth/mgmt.c:1910 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195
Freed by task 5991: mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline]
mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257 mgmt_index_removed+0x112/0x2f0 net/bluetooth/mgmt.c:9477 hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/24/2026
The vulnerability identified as CVE-2025-68305 resides within the Linux kernel's Bluetooth implementation, specifically in the handling of socket operations and management commands. This issue manifests as a race condition between the socket bind operation and the socket write iteration process, creating a potential use-after-free scenario that could be exploited to compromise system integrity. The vulnerability was reported by syzbot, a fuzzing tool designed to identify kernel-level issues, and is classified as a use-after-free condition that occurs during Bluetooth management command processing. The race condition arises when the bind operation attempts to free a management pending command structure while a concurrent write iteration operation is still referencing it, leading to memory corruption and potential privilege escalation.
The technical flaw stems from inadequate synchronization between concurrent operations within the Bluetooth subsystem. When a socket undergoes binding, it may invoke management pending functions that free command structures, while simultaneously, a write iteration operation might be attempting to access the same freed memory. The call trace shows that mgmt_pending_remove is called with a freed pointer, indicating that the memory management sequence has been disrupted. This condition is particularly concerning because it involves core kernel components that handle Bluetooth device management, including the hci_sock module and mgmt_util.c functions. The race condition occurs in the hci_sock_sendmsg function where the socket write iteration process interacts with management commands, while hci_sock_bind processes the socket binding operations that can free the same memory structures.
The operational impact of this vulnerability extends beyond simple memory corruption, as it could allow malicious actors to execute arbitrary code with kernel privileges. The use-after-free condition creates opportunities for attackers to manipulate memory layout and potentially redirect execution flow through controlled data corruption. This type of vulnerability is particularly dangerous in embedded systems or devices that rely heavily on Bluetooth connectivity, as it could be exploited to gain unauthorized access to sensitive system resources. The vulnerability affects systems running Linux kernel versions that include the affected Bluetooth management code, particularly those implementing Bluetooth socket operations and management command processing. According to the ATT&CK framework, this vulnerability aligns with techniques such as privilege escalation and code injection, while CWE-362 categorizes it as a race condition vulnerability that can lead to memory corruption and system compromise.
Mitigation strategies for CVE-2025-68305 focus on implementing proper locking mechanisms to synchronize access to shared resources between socket binding and write iteration operations. The fix involves using hci_dev_lock to ensure that management pending commands are not freed while concurrent write operations are accessing them, effectively preventing the use-after-free condition. System administrators should prioritize updating to kernel versions that include this fix, as the vulnerability requires kernel-level modifications to resolve properly. Additionally, monitoring for unusual Bluetooth socket behavior and implementing proper access controls for Bluetooth services can help detect potential exploitation attempts. The fix aligns with security best practices outlined in the Linux kernel security guidelines, emphasizing the importance of proper synchronization in concurrent programming scenarios. Organizations should also consider implementing network segmentation and access controls to limit potential exploitation of Bluetooth-related vulnerabilities, particularly in environments where Bluetooth connectivity is not essential to core operations.