CVE-2025-40309: Bluetooth: SCO: Fix UAF on sco_conn_free
Published Dec 8, 2025
·Updated
Bluetooth: SCO: Fix UAF on scoconnfree
Affected Software
1 affected component
Linux Linux kernel=6.17.0-rc5-g717368f83676
Event History
Dec 8, 2025
CVE Published
via MITRE·12:46 AM
Data Sourced
via MITRE·12:46 AM
DescriptionSeverity
Data Sourced
via NVD·01:16 AM
DescriptionSeverity
Dec 9, 2025
Data Sourced
via Microsoft·01:01 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-40309?
CVE-2025-40309 has a medium severity due to the potential for a use-after-free vulnerability affecting Bluetooth SCO connections.
2
How do I fix CVE-2025-40309?
To address CVE-2025-40309, update the Linux kernel to the latest patched version that resolves this vulnerability.
3
What systems are affected by CVE-2025-40309?
CVE-2025-40309 affects the Linux kernel, particularly implementations that utilize Bluetooth SCO functionality.
4
What could happen if I don't address CVE-2025-40309?
If unpatched, CVE-2025-40309 could lead to application crashes or potential privilege escalation due to the use-after-free condition.
5
When was CVE-2025-40309 disclosed?
CVE-2025-40309 was disclosed following the identification of the vulnerability in the Linux kernel's Bluetooth SCO handling.