CVE-2025-38099: Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken
Bluetooth: Disable SCO support if READVOICESETTING is unsupported/broken
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.32-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.31 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.14.9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-aws-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-nvidia-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-gcp-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1016.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oem-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1012.12 - Upgrade
Upgrade
ubuntu/linux-oracle-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-32.32.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1012.12~24.04.1 - Configuration
Disable SCO support when READ_VOICE_SETTING is unsupported or broken to prevent controller lockups.
Bluetooth SCO support = disabled
Event History
Frequently Asked Questions
What level of access is required to trigger this issue?
The CVSS vector indicates that an attacker needs local access and low privileges. No user interaction is required.
What is the likely impact if the issue is exploited?
A SCO connection created without the proper voice_setting can cause the Bluetooth controller to lock up, resulting in an availability impact. The CVSS vector indicates no confidentiality or integrity impact.
When is a system exposed to the controller lockup condition?
The issue applies when SCO support is used on a Bluetooth controller for which READ_VOICE_SETTING is unsupported or broken. The provided data does not state whether affected SCO usage is enabled by default.
Is a fix available?
Yes. A patch is available, with fixes referenced in the listed Linux stable kernel commits.