7.8 CVE-2025-39860

Enriched by CISA Patch
 

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the "Freed by task" part. Let's call l2cap_sock_cleanup_listen() under lock_sock() in l2cap_sock_release(). [0]: BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995 CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 spin_lock_bh include/linux/spinlock.h:356 [inline] release_sock+0x21/0x220 net/core/sock.c:3746 bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2accf8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f R10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490 </TASK> Allocated by task 5326: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4365 [inline] __kmalloc_nopro ---truncated---
https://nvd.nist.gov/vuln/detail/CVE-2025-39860

Categories

CWE-416 : Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. If the product accesses a previously-freed pointer, then it means that a separate weakness or error already occurred previously, such as a race condition, an unexpected or poorly handled error condition, confusion over which part of the program is responsible for freeing the memory, performing the free too soon, etc. a pointer that no longer points to valid memory, often after it has been freed commonly used acronym for Use After Free Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues. Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) Use tools that are integrated duringcompilation to insert runtime error-checking mechanismsrelated to memory safety errors, such as AddressSanitizer(ASan) for C/C++ [REF-1518]. Choose a language that provides automatic memory management. When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy. TCP/IP code for an OS has a use-after-free that can leak heap memory contents Chain: an operating system kernel has insufficent resource locking (CWE-413) leading to a use after free (CWE-416). Chain: two threads in a web browser use the same resource (CWE-366), but one of those threads can destroy the resource before the other has completed (CWE-416). Chain: mobile platform race condition (CWE-362) leading to use-after-free (CWE-416), as exploited in the wild per CISA KEV. Chain: race condition (CWE-362) leads to use-after-free (CWE-416), as exploited in the wild per CISA KEV. Use-after-free triggered by closing a connection while data is still being transmitted. Improper allocation for invalid data leads to use-after-free. certificate with a large number of Subject Alternate Names not properly handled in realloc, leading to use-after-free Timers are not disabled when a related object is deleted Access to a "dead" object that is being cleaned up object is deleted even with a non-zero reference count, and later accessed use-after-free involving request containing an invalid version number unload of an object that is currently being accessed by other functionality incorrectly tracking a reference count leads to use-after-free use-after-free related to use of uninitialized memory HTML document with incorrectly-nested tags Use after free in ActiveX object by providing a malformed argument to a method use-after-free by disconnecting during data transfer, or a message containing incorrect data types disconnect during a large data transfer causes incorrect reference count, leading to use-after-free use-after-free found by fuzzing Chain: race condition (CWE-362) from improper handling of a page transition in web client while an applet is loading (CWE-368) leads to use after free (CWE-416) realloc generates new buffer and pointer, but previous pointer is still retained, leading to use after free Use-after-free in web browser, probably resultant from not initializing memory. use-after-free when one thread accessed memory that was freed by another thread assignment of malformed values to certain properties triggers use after free mail server does not properly handle a long header. chain: integer overflow leads to use-after-free freed pointer dereference Chain: A multi-threaded race condition (CWE-367) allows attackers to cause two threads to process the same RPC request, which causes a use-after-free (CWE-416) in one thread

References


 

AFFECTED (from MITRE)


Vendor Product Versions
Linux Linux
  • a2da00d1ea1abfb04f846638e210b5b5166e3c9c < 964cbb198f9c46c2b2358cd1faffc04c1e8248cf [affected]
  • 06f87c96216bc5cd1094c23492274f77f1d5dd3b < 83e1d9892ef51785cf0760b7681436760dda435a [affected]
  • fbe5a2fed8156cc19eb3b956602b0a1dd46a302d < 47f6090bcf75c369695d21c3f179db8a56bbbd49 [affected]
  • 29fac18499332211b2615ade356e2bd8b3269f98 < 2ca99fc3512a8074de20ee52a87b492dfcc41a4d [affected]
  • 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 < 6077d16b5c0f65d571eee709de2f0541fb5ef0ca [affected]
  • 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 < 306b0991413b482dbf5585b423022123bb505966 [affected]
  • 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 < 3dff390f55ccd9ce12e91233849769b5312180c2 [affected]
  • 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 < 862c628108562d8c7a516a900034823b381d3cba [affected]
  • 51822644a047eac2310fab0799b64e3430b5a111 [affected]
  • 82cdb2ccbe43337798393369f0ceb98699fe6037 [affected]
  • 10426afe65c8bf7b24dd0c7be4dcc65f86fc99f9 [affected]
  • 5.4.253 < 5.4.299 [affected]
  • 5.10.190 < 5.10.243 [affected]
  • 5.15.126 < 5.15.192 [affected]
  • 6.1.45 < 6.1.151 [affected]
  • 4.14.322 < 4.15 [affected]
  • 4.19.291 < 4.20 [affected]
  • 6.4.10 < 6.5 [affected]
Linux Linux
  • 6.5 [affected]
  • < 6.5 [unaffected]
  • 5.4.299 ≤ 5.4.* [unaffected]
  • 5.10.243 ≤ 5.10.* [unaffected]
  • 5.15.192 ≤ 5.15.* [unaffected]
  • 6.1.151 ≤ 6.1.* [unaffected]
  • 6.6.105 ≤ 6.6.* [unaffected]
  • 6.12.46 ≤ 6.12.* [unaffected]
  • 6.16.6 ≤ 6.16.* [unaffected]
  • 6.17 ≤ * [unaffected]
© 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

CPE

cpe start end
Configuration 1
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* >= 4.14.322 < 4.15
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* >= 4.19.291 < 4.20
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* >= 5.4.253 < 5.4.299
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* >= 5.10.190 < 5.10.243
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* >= 5.15.126 < 5.15.192
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* >= 6.1.45 < 6.1.151
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* >= 6.4.10 < 6.6.105
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* >= 6.7 < 6.12.46
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* >= 6.13 < 6.16.6
cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*
Configuration 2
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*


REMEDIATION


Patch

Url
https://git.kernel.org/stable/c/2ca99fc3512a8074de20ee52a87b492dfcc41a4d
https://git.kernel.org/stable/c/306b0991413b482dbf5585b423022123bb505966
https://git.kernel.org/stable/c/3dff390f55ccd9ce12e91233849769b5312180c2
https://git.kernel.org/stable/c/47f6090bcf75c369695d21c3f179db8a56bbbd49
https://git.kernel.org/stable/c/6077d16b5c0f65d571eee709de2f0541fb5ef0ca
https://git.kernel.org/stable/c/83e1d9892ef51785cf0760b7681436760dda435a
https://git.kernel.org/stable/c/862c628108562d8c7a516a900034823b381d3cba
https://git.kernel.org/stable/c/964cbb198f9c46c2b2358cd1faffc04c1e8248cf


EXPLOITS


Exploit-db.com

id description date
No known exploits

POC Github

Url
No known exploits

Other Nist (github, ...)

Url
No known exploits


CAPEC


Common Attack Pattern Enumerations and Classifications

id description severity
No entry