CVE-2025-38473

Updated:

Description:

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() syzbot reported null-ptr-deref in l2cap_sock_resume_cb(). [0] l2cap_sock_resume_cb() has a similar problem that was fixed by commit 1bff51ea59a9 ("Bluetooth: fix use-after-free error in lock_sock_nested()"). Since both l2cap_sock_kill() and l2cap_sock_resume_cb() are executed under l2cap_sock_resume_cb(), we can avoid the issue simply by checking if chan->data is NULL. Let's not access to the killed socket in l2cap_sock_resume_cb(). [0]: BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:82 [inline] BUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] BUG: KASAN: null-ptr-deref in l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711 Write of size 8 at addr 0000000000000570 by task kworker/u9:0/52 CPU: 1 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Workqueue: hci0 hci_rx_work Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:501 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_report+0x58/0x84 mm/kasan/report.c:524 kasan_report+0xb0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189 __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37 instrument_atomic_write include/linux/instrumented.h:82 [inline] clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711 l2cap_security_cfm+0x524/0xea0 net/bluetooth/l2cap_core.c:7357 hci_auth_cfm include/net/bluetooth/hci_core.h:2092 [inline] hci_auth_complete_evt+0x2e8/0xa4c net/bluetooth/hci_event.c:3514 hci_event_func net/bluetooth/hci_event.c:7511 [inline] hci_event_packet+0x650/0xe9c net/bluetooth/hci_event.c:7565 hci_rx_work+0x320/0xb18 net/bluetooth/hci_core.c:4070 process_one_work+0x7e8/0x155c kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3321 [inline] worker_thread+0x958/0xed8 kernel/workqueue.c:3402 kthread+0x5fc/0x75c kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847

CVSS3: 7


Vendor State

OS Vendor version Errata
Oracle Linux 7 UEK 6 5.4.17-2136.348.3.el7uek ELSA-2025-20663
Oracle Linux 8 UEK 6 5.4.17-2136.348.3.el8uek ELSA-2025-20663
Debian 11 5.10.244-1 DLA-4327-1
Ubuntu 22.04 5.15.0-163.173 USN-7909-1
Ubuntu 22.04 AWS 5.15.0-1097.104 USN-7909-1
Debian 11 cloud 5.10.244-1 DLA-4327-1
Oracle Linux 9 UEK 7 5.15.0-314.193.5.3.el9uek ELSA-2025-25757
Oracle Linux 8 UEK 7 5.15.0-314.193.5.3.el8uek ELSA-2025-25757
Debian 12 6.1.147-1 DSA-5973-1

KernelCare State

OS Original kernel version State
Oracle Linux 7 UEK 6
5.4.17-2011.2.2.el7uek show all hide all
5.4.17-2011.1.2.el7uek 5.4.17-2011.3.2.1.el7uek 5.4.17-2011.0.7.el7uek 5.4.17-2011.4.4.el7uek 5.4.17-2011.4.6.el7uek 5.4.17-2011.5.3.el7uek 5.4.17-2011.6.2.el7uek 5.4.17-2011.7.4.el7uek 5.4.17-2036.100.6.1.el7uek 5.4.17-2036.101.2.el7uek 5.4.17-2036.102.0.2.el7uek 5.4.17-2036.103.3.el7uek 5.4.17-2036.103.3.1.el7uek 5.4.17-2036.104.4.el7uek 5.4.17-2036.104.5.el7uek 5.4.17-2102.200.13.el7uek 5.4.17-2102.201.3.el7uek 5.4.17-2102.202.5.el7uek 5.4.17-2102.203.5.el7uek 5.4.17-2102.203.6.el7uek 5.4.17-2102.204.4.2.el7uek 5.4.17-2102.204.4.3.el7uek 5.4.17-2102.204.4.4.el7uek 5.4.17-2102.205.7.2.el7uek 5.4.17-2102.205.7.3.el7uek 5.4.17-2102.206.1.el7uek 5.4.17-2136.300.7.el7uek 5.4.17-2136.301.1.2.el7uek 5.4.17-2136.301.1.4.el7uek 5.4.17-2136.302.6.1.el7uek 5.4.17-2136.302.7.2.el7uek 5.4.17-2136.302.7.2.1.el7uek 5.4.17-2136.301.1.3.el7uek 5.4.17-2136.302.7.2.2.el7uek 5.4.17-2136.302.7.2.3.el7uek 5.4.17-2136.304.4.1.el7uek 5.4.17-2136.304.4.2.el7uek 5.4.17-2136.304.4.3.el7uek 5.4.17-2136.304.4.4.el7uek 5.4.17-2136.304.4.5.el7uek 5.4.17-2136.305.5.3.el7uek 5.4.17-2136.305.5.4.el7uek 5.4.17-2136.305.5.5.el7uek 5.4.17-2136.306.1.3.el7uek 5.4.17-2136.307.3.1.el7uek 5.4.17-2136.307.3.2.el7uek 5.4.17-2136.307.3.4.el7uek 5.4.17-2136.307.3.5.el7uek 5.4.17-2136.308.7.el7uek 5.4.17-2136.307.3.6.el7uek 5.4.17-2136.308.9.el7uek 5.4.17-2136.309.5.el7uek 5.4.17-2136.309.5.1.el7uek 5.4.17-2136.310.7.el7uek 5.4.17-2136.310.7.1.el7uek 5.4.17-2136.309.4.el7uek 5.4.17-2136.311.6.el7uek 5.4.17-2136.311.6.1.el7uek 5.4.17-2136.312.3.4.el7uek 5.4.17-2136.313.6.el7uek 5.4.17-2136.314.6.2.el7uek 5.4.17-2136.314.6.3.el7uek 5.4.17-2136.315.5.el7uek 5.4.17-2136.316.7.el7uek 5.4.17-2136.315.5.8.el7uek 5.4.17-2136.317.5.3.el7uek 5.4.17-2136.317.5.5.el7uek 5.4.17-2136.318.7.1.el7uek 5.4.17-2136.318.7.2.el7uek 5.4.17-2136.319.1.2.el7uek 5.4.17-2136.319.1.3.el7uek 5.4.17-2136.319.1.4.el7uek 5.4.17-2136.320.7.el7uek 5.4.17-2136.320.7.1.el7uek 5.4.17-2136.321.4.el7uek 5.4.17-2136.322.6.2.el7uek 5.4.17-2136.323.8.el7uek 5.4.17-2136.323.8.1.el7uek 5.4.17-2136.323.8.2.el7uek 5.4.17-2136.321.4.1.el7uek 5.4.17-2136.324.5.3.el7uek 5.4.17-2136.322.6.3.el7uek 5.4.17-2136.325.5.el7uek 5.4.17-2136.325.5.1.el7uek 5.4.17-2136.326.6.el7uek 5.4.17-2136.326.6.1.el7uek 5.4.17-2136.327.2.el7uek 5.4.17-2136.328.3.el7uek 5.4.17-2136.329.3.1.el7uek 5.4.17-2136.322.6.4.el7uek 5.4.17-2136.329.3.2.el7uek 5.4.17-2136.330.7.1.el7uek 5.4.17-2136.331.7.el7uek 5.4.17-2136.322.6.5.el7uek 5.4.17-2136.330.7.4.el7uek 5.4.17-2136.332.5.2.el7uek 5.4.17-2136.333.5.el7uek 5.4.17-2136.330.7.5.el7uek 5.4.17-2136.333.5.1.el7uek 5.4.17-2136.334.6.el7uek 5.4.17-2136.334.6.1.el7uek 5.4.17-2136.335.4.el7uek 5.4.17-2136.335.4.1.el7uek 5.4.17-2136.336.5.1.el7uek 5.4.17-2136.337.5.el7uek 5.4.17-2136.337.5.1.el7uek 5.4.17-2136.336.5.3.el7uek 5.4.17-2136.336.5.3.1.el7uek 5.4.17-2136.336.5.3.2.el7uek 5.4.17-2136.338.4.1.el7uek 5.4.17-2136.338.4.2.el7uek
Released
Oracle Linux 8 UEK 6
5.4.17-2011.2.2.el8uek show all hide all
5.4.17-2011.1.2.el8uek 5.4.17-2011.3.2.1.el8uek 5.4.17-2011.0.7.el8uek 5.4.17-2011.4.4.el8uek 5.4.17-2011.4.6.el8uek 5.4.17-2011.5.3.el8uek 5.4.17-2011.6.2.el8uek 5.4.17-2011.7.4.el8uek 5.4.17-2036.100.6.1.el8uek 5.4.17-2036.101.2.el8uek 5.4.17-2036.102.0.2.el8uek 5.4.17-2036.103.3.el8uek 5.4.17-2036.103.3.1.el8uek 5.4.17-2036.104.4.el8uek 5.4.17-2036.104.5.el8uek 5.4.17-2102.200.13.el8uek 5.4.17-2102.201.3.el8uek 5.4.17-2102.202.5.el8uek 5.4.17-2102.203.5.el8uek 5.4.17-2102.203.6.el8uek 5.4.17-2102.204.4.2.el8uek 5.4.17-2102.204.4.3.el8uek 5.4.17-2102.204.4.4.el8uek 5.4.17-2102.205.7.2.el8uek 5.4.17-2102.205.7.3.el8uek 5.4.17-2102.206.1.el8uek 5.4.17-2136.300.7.el8uek 5.4.17-2136.301.1.2.el8uek 5.4.17-2136.301.1.4.el8uek 5.4.17-2136.302.6.1.el8uek 5.4.17-2136.302.7.2.el8uek 5.4.17-2136.302.7.2.1.el8uek 5.4.17-2136.301.1.3.el8uek 5.4.17-2136.302.7.2.2.el8uek 5.4.17-2136.302.7.2.3.el8uek 5.4.17-2136.304.4.1.el8uek 5.4.17-2136.304.4.2.el8uek 5.4.17-2136.304.4.3.el8uek 5.4.17-2136.304.4.4.el8uek 5.4.17-2136.304.4.5.el8uek 5.4.17-2136.305.5.3.el8uek 5.4.17-2136.305.5.4.el8uek 5.4.17-2136.305.5.5.el8uek 5.4.17-2136.306.1.3.el8uek 5.4.17-2136.307.3.1.el8uek 5.4.17-2136.307.3.2.el8uek 5.4.17-2136.307.3.4.el8uek 5.4.17-2136.307.3.5.el8uek 5.4.17-2136.308.7.el8uek 5.4.17-2136.307.3.6.el8uek 5.4.17-2136.308.9.el8uek 5.4.17-2136.309.5.el8uek 5.4.17-2136.309.5.1.el8uek 5.4.17-2136.310.7.el8uek 5.4.17-2136.310.7.1.el8uek 5.4.17-2136.309.4.el8uek 5.4.17-2136.311.6.el8uek 5.4.17-2136.311.6.1.el8uek 5.4.17-2136.312.3.4.el8uek 5.4.17-2136.313.6.el8uek 5.4.17-2136.314.6.2.el8uek 5.4.17-2136.314.6.3.el8uek 5.4.17-2136.315.5.el8uek 5.4.17-2136.316.7.el8uek 5.4.17-2136.315.5.8.el8uek 5.4.17-2136.317.5.3.el8uek 5.4.17-2136.317.5.5.el8uek 5.4.17-2136.318.7.1.el8uek 5.4.17-2136.318.7.2.el8uek 5.4.17-2136.319.1.2.el8uek 5.4.17-2136.319.1.3.el8uek 5.4.17-2136.319.1.4.el8uek 5.4.17-2136.320.7.el8uek 5.4.17-2136.320.7.1.el8uek 5.4.17-2136.321.4.el8uek 5.4.17-2136.321.4.1.el8uek 5.4.17-2136.322.6.2.el8uek 5.4.17-2136.323.8.el8uek 5.4.17-2136.323.8.1.el8uek 5.4.17-2136.323.8.2.el8uek 5.4.17-2136.324.5.2.el8uek 5.4.17-2136.324.5.3.el8uek 5.4.17-2136.322.6.3.el8uek 5.4.17-2136.325.5.el8uek 5.4.17-2136.325.5.1.el8uek 5.4.17-2136.326.6.el8uek 5.4.17-2136.326.6.1.el8uek 5.4.17-2136.327.2.el8uek 5.4.17-2136.328.3.el8uek 5.4.17-2136.329.3.1.el8uek 5.4.17-2136.322.6.4.el8uek 5.4.17-2136.329.3.2.el8uek 5.4.17-2136.330.7.1.el8uek 5.4.17-2136.331.7.el8uek 5.4.17-2136.322.6.5.el8uek 5.4.17-2136.330.7.4.el8uek 5.4.17-2136.332.5.2.el8uek 5.4.17-2136.333.5.el8uek 5.4.17-2136.330.7.5.el8uek 5.4.17-2136.333.5.1.el8uek 5.4.17-2136.334.6.el8uek 5.4.17-2136.334.6.1.el8uek 5.4.17-2136.335.4.el8uek 5.4.17-2136.335.4.1.el8uek 5.4.17-2136.336.5.1.el8uek 5.4.17-2136.337.5.el8uek 5.4.17-2136.337.5.1.el8uek 5.4.17-2136.336.5.3.el8uek 5.4.17-2136.336.5.3.1.el8uek 5.4.17-2136.336.5.3.2.el8uek 5.4.17-2136.338.4.1.el8uek 5.4.17-2136.338.4.2.el8uek 5.4.17-2136.339.5.el8uek 5.4.17-2136.339.5.1.el8uek 5.4.17-2136.339.5.2.el8uek 5.4.17-2136.340.4.1.el8uek 5.4.17-2136.341.3.3.el8uek 5.4.17-2136.341.3.1.el8uek 5.4.17-2136.342.5.el8uek 5.4.17-2136.342.5.3.el8uek 5.4.17-2136.343.5.1.el8uek 5.4.17-2136.344.4.1.el8uek 5.4.17-2136.343.5.3.el8uek 5.4.17-2136.344.4.3.el8uek 5.4.17-2136.345.5.3.el8uek 5.4.17-2136.346.6.el8uek 5.4.17-2136.343.5.5.el8uek 5.4.17-2136.347.6.el8uek 5.4.17-2136.347.6.1.el8uek 5.4.17-2136.347.6.2.el8uek 5.4.17-2136.347.6.3.el8uek 5.4.17-2136.343.5.6.el8uek 5.4.17-2136.347.6.4.el8uek
Released
Debian 11
Planned
Ubuntu 22.04
Planned
Ubuntu 22.04 AWS
Planned
Debian 11 cloud
Planned
Oracle Linux 9 UEK 7
Planned
Oracle Linux 8 UEK 7
Planned
Debian 12
6.1.38-1 show all hide all
6.1.38-2 6.1.38-4 6.1.52-1 6.1.55-1 6.1.64-1 6.1.66-1 6.1.69-1 6.1.76-1 6.1.27-1 6.1.67-1 6.1.85-1 6.1.90-1 6.1.94-1 6.1.99-1 6.1.106-3 6.1.112-1 6.1.115-1 6.1.119-1 6.1.123-1 6.1.128-1 6.1.124-1 6.1.129-1 6.1.133-1 6.1.135-1 6.1.137-1 6.1.140-1 6.1.139-1
Released