-

CVE-2025-40284

Bluetooth: MGMT: cancel mesh send timer when hdev removed

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: cancel mesh send timer when hdev removed

mesh_send_done timer is not canceled when hdev is removed, which causes
crash if the timer triggers after hdev is gone.

Cancel the timer when MGMT removes the hdev, like other MGMT timers.

Should fix the BUG: sporadically seen by BlueZ test bot
(in "Mesh - Send cancel - 1" test).

Log:
------
BUG: KASAN: slab-use-after-free in run_timer_softirq+0x76b/0x7d0
...
Freed by task 36:
 kasan_save_stack+0x24/0x50
 kasan_save_track+0x14/0x30
 __kasan_save_free_info+0x3a/0x60
 __kasan_slab_free+0x43/0x70
 kfree+0x103/0x500
 device_release+0x9a/0x210
 kobject_put+0x100/0x1e0
 vhci_release+0x18b/0x240
------
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version b338d91703fae6f6afd67f3f75caa3b8f36ddef3
Version < 990e6143b0ca0c66f099d67d00c112bf59b30d76
Status affected
Version b338d91703fae6f6afd67f3f75caa3b8f36ddef3
Version < 2927ff643607eddf4f03d10ef80fe10d977154aa
Status affected
Version b338d91703fae6f6afd67f3f75caa3b8f36ddef3
Version < 7b6b6c077cad0601d62c3c34ab7ce3fb25deda7b
Status affected
Version b338d91703fae6f6afd67f3f75caa3b8f36ddef3
Version < fd62ca5ad136dcf6f5aa308423b299a6be6f54ea
Status affected
Version b338d91703fae6f6afd67f3f75caa3b8f36ddef3
Version < 55fb52ffdd62850d667ebed842815e072d3c9961
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.1
Status affected
Version 0
Version < 6.1
Status unaffected
Version <= 6.1.*
Version 6.1.159
Status unaffected
Version <= 6.6.*
Version 6.6.117
Status unaffected
Version <= 6.12.*
Version 6.12.59
Status unaffected
Version <= 6.17.*
Version 6.17.9
Status unaffected
Version <= *
Version 6.18
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.06% 0.175
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.