CVE-2025-38592: Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcidevcddump: fix out-of-bounds via devcoredumpv
Currently both devcoredumpv and skbputdata in hcidevcddump use hdev->dump.head. However, devcoredumpv can free the buffer. From devcoredumpmtimeout documentation, which is used by devcoredumpv:
> Creates a new device coredump for the given device. If a previous one hasn't > been read yet, the new coredump is discarded. The data lifetime is determined > by the device coredump framework and when it is no longer needed the @free > function will be called to free the data.
If the data has not been read by the userspace yet, devcoredumpv will discard new buffer, freeing hdev->dump.head. This leads to vmalloc-out-of-bounds error when skbputdata tries to access hdev->dump.head.
A crash report from syzbot illustrates this:
================================================================== BUG: KASAN: vmalloc-out-of-bounds in skbputdata include/linux/skbuff.h:2752 [inline] BUG: KASAN: vmalloc-out-of-bounds in hcidevcddump+0x142/0x240 net/bluetooth/coredump.c:258 Read of size 140 at addr ffffc90004ed5000 by task kworker/u9:2/5844
CPU: 1 UID: 0 PID: 5844 Comm: kworker/u9:2 Not tainted 6.14.0-syzkaller-10892-g4e82c87058f4 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: hci0 hcidevcdtimeout Call Trace: <TASK> dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x116/0x1f0 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:408 [inline] printreport+0xc3/0x670 mm/kasan/report.c:521 kasanreport+0xe0/0x110 mm/kasan/report.c:634 checkregioninline mm/kasan/generic.c:183 [inline] kasancheckrange+0xef/0x1a0 mm/kasan/generic.c:189 asanmemcpy+0x23/0x60 mm/kasan/shadow.c:105 skbputdata include/linux/skbuff.h:2752 [inline] hcidevcddump+0x142/0x240 net/bluetooth/coredump.c:258 hcidevcdtimeout+0xb5/0x2e0 net/bluetooth/coredump.c:413 processonework+0x9cc/0x1b70 kernel/workqueue.c:3238 processscheduledworks kernel/workqueue.c:3319 [inline] workerthread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 retfromfork+0x45/0x80 arch/x86/kernel/process.c:153 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:245 </TASK>
The buggy address ffffc90004ed5000 belongs to a vmalloc virtual mapping Memory state around the buggy address: ffffc90004ed4f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90004ed4f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 >ffffc90004ed5000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc90004ed5080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90004ed5100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ==================================================================
To avoid this issue, reorder devcoredumpv to be called after skbputdata that does not free the data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.14.0-syzkaller-10892-g4e82c87058f4 - Configuration
Reorder the call so dev_coredumpv is invoked only after dev_coredumpm_timeout has run its discard/free path (as described: “To avoid this issue, reorder dev_coredumpv to be called after dev_coredumpm_timeout”).
Bluetooth hci_devcd_dump (net/bluetooth/coredump.c) dev_coredumpv call order relative to dev_coredumpm_timeout (hci_devcd_timeout workqueue path) = Call dev_coredumpv after dev_coredumpm_timeout/discard logic to ensure buffer lifetime safety
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38592?
CVE-2025-38592 has been rated as a high severity vulnerability due to the potential for out-of-bounds access.
How do I fix CVE-2025-38592?
To fix CVE-2025-38592, update the Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2025-38592?
CVE-2025-38592 affects the Linux kernel, specifically related to Bluetooth functionalities.
Is CVE-2025-38592 exploitable remotely?
CVE-2025-38592 may be exploited remotely if the Bluetooth functionality is enabled and accessible.
What impact does CVE-2025-38592 have on system security?
The impact of CVE-2025-38592 includes potential denial of service or arbitrary code execution due to out-of-bounds access.