CVE-2025-40308: Bluetooth: bcsp: receive data only if registered
Bluetooth: bcsp: receive data only if registered
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Modify bcsp_recv() to return without processing received data unless the HCI_UART_REGISTERED flag is set.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40308?
CVE-2025-40308 has been classified as a moderate severity vulnerability due to its potential to cause system crashes through NULL pointer dereference.
How do I fix CVE-2025-40308?
To fix CVE-2025-40308, you should upgrade to the latest version of the Linux kernel where the vulnerability has been patched.
What component of the Linux kernel is affected by CVE-2025-40308?
CVE-2025-40308 specifically affects the Bluetooth BCSP protocol implementation within the Linux kernel.
What is the impact of CVE-2025-40308?
The impact of CVE-2025-40308 includes potential denial of service due to system instability caused by a NULL pointer dereference.
Can CVE-2025-40308 be exploited remotely?
CVE-2025-40308 requires local access to the system, hence it cannot be exploited remotely.