UBUNTU-CVE-2025-40318: High severity ubuntu/linux-hwe-edge vulnerability

Q: What access does an attacker need to exploit this issue?

The vulnerability is locally exploitable and requires low privileges. No user interaction is required, but the provided data does not specify the exact local interface or Bluetooth operations needed to trigger the race.

Q: Which Ubuntu kernel packages are identified as affected?

The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-hwe-edge, ubuntu/linux-gke, and ubuntu/linux-gkeop.

Q: What is the impact if the race is triggered?

Concurrent removal of the same command-synchronization entry can cause a double list_del() operation and a use-after-free condition. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability of the vulnerable system.

Published Dec 8, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: fix race in hcicmdsyncdequeueonce hcicmdsyncdequeueonce() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hcicmdsyncwork() can also delete the same entry, leading to double listdel() and "UAF". Fix this by holding cmdsyncworklock across both lookup and cancel, so that the entry cannot be removed concurrently.

Affected Software

147 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1050.53~22.04.1

6.8.0-1050.53~22.04.1

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1051.57~22.04.1

6.8.0-1051.57~22.04.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1058.65~22.04.1

6.8.0-1058.65~22.04.1

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1052.55~22.04.1

6.8.0-1052.55~22.04.1

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-106.106~22.04.1

6.8.0-106.106~22.04.1

ubuntu/linux-ibm-6.8<6.8.0-1049.49~22.04.1

6.8.0-1049.49~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-106.106.1~22.04.1

6.8.0-106.106.1~22.04.1

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1049.52~22.04.1

6.8.0-1049.52~22.04.1

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1047.48~22.04.1

6.8.0-1047.48~22.04.1

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-106.106~22.04.1

6.8.0-106.106~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime-6.8<6.8.1-1045.46~22.04.1

6.8.1-1045.46~22.04.1

ubuntu/linux<6.8.0-106.106

6.8.0-106.106

ubuntu/linux-aws<6.8.0-1050.53

6.8.0-1050.53

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17<6.17.0-1007.7~24.04.1

6.17.0-1007.7~24.04.1

ubuntu/linux-azure<6.8.0-1051.57

6.8.0-1051.57

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-fde<6.8.0-1058.65

6.8.0-1058.65

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia<6.8.0-1039.42

6.8.0-1039.42

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1052.55

6.8.0-1052.55

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-6.17<6.17.0-1008.8~24.04.1

6.17.0-1008.8~24.04.1

ubuntu/linux-gke<6.8.0-1048.53

6.8.0-1048.53

ubuntu/linux-gkeop<6.8.0-1035.38

6.8.0-1035.38

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-ibm<6.8.0-1049.49

6.8.0-1049.49

ubuntu/linux-lowlatency<6.8.0-106.106.1

6.8.0-106.106.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1049.52

6.8.0-1049.52

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17<6.17.0-1008.8

6.17.0-1008.8

ubuntu/linux-nvidia-lowlatency<6.8.0-1049.52.1

6.8.0-1049.52.1

ubuntu/linux-nvidia-tegra<6.8.0-1020.20

6.8.0-1020.20

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17<6.17.0-1011.11

6.17.0-1011.11

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1047.48

6.8.0-1047.48

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17<6.17.0-1007.7~24.04.1

6.17.0-1007.7~24.04.1

ubuntu/linux-raspi<6.8.0-1050.54

6.8.0-1050.54

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-xilinx<6.8.0-1028.29

6.8.0-1028.29

ubuntu/linux-bluefield<6.8.0-1017.21

6.8.0-1017.21

ubuntu/linux-raspi-realtime<6.8.0-2040.41

6.8.0-2040.41

ubuntu/linux-realtime<6.8.1-1045.46

6.8.1-1045.46

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17<6.17.0-1006.7~24.04.1

6.17.0-1006.7~24.04.1

ubuntu/linux-aws-fips<6.8.0-1050.53+fips1

6.8.0-1050.53+fips1

ubuntu/linux-azure-fips<6.8.0-1052.58+fips1

6.8.0-1052.58+fips1

ubuntu/linux-fips<6.8.0-106.106+fips1

6.8.0-106.106+fips1

ubuntu/linux-gcp-fips<6.8.0-1052.55+fips1

6.8.0-1052.55+fips1

ubuntu/linux<6.17.0-14.14

6.17.0-14.14

ubuntu/linux-aws<6.17.0-1007.7

6.17.0-1007.7

ubuntu/linux-azure<6.17.0-1008.8

6.17.0-1008.8

ubuntu/linux-azure-fde*

ubuntu/linux-gcp<6.17.0-1007.7

6.17.0-1007.7

ubuntu/linux-oracle<6.17.0-1007.7

6.17.0-1007.7

ubuntu/linux-raspi<6.17.0-1008.8

6.17.0-1008.8

ubuntu/linux-realtime<6.17.0-1006.7

6.17.0-1006.7

ubuntu/linux-riscv<6.17.0-14.14.1

6.17.0-14.14.1

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.53~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.57~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.65~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.55~22.04.1
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-106.106~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.49~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-106.106.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.52~22.04.1
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.48~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-106.106~22.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1045.46~22.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-106.106
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.53
Upgrade
Upgrade ubuntu/linux-aws-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1007.7~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.57
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.65
Upgrade
Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1039.42
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.55
Upgrade
Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1008.8~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1048.53
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1035.38
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.49
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-106.106.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.52
Upgrade
Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1008.8
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.52.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1020.20
Upgrade
Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1011.11
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.48
Upgrade
Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1007.7~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.54
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.29
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1017.21
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2040.41
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1045.46
Upgrade
Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1006.7~24.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.53+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.58+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-106.106+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.55+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.17.0-14.14
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.17.0-1007.7
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.17.0-1008.8
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.17.0-1007.7
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.17.0-1007.7
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.17.0-1008.8
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.17.0-1006.7
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 6.17.0-14.14.1
Compensating control
Hold cmd_sync_work_lock across both the lookup and cancel operations in hci_cmd_sync_dequeue_once() so the entry cannot be removed concurrently by hci_cmd_sync_work().

Event History

Dec 8, 2025

CVE Published

via OSV·01:16 AM

Data Sourced

via OSV·01:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability is locally exploitable and requires low privileges. No user interaction is required, but the provided data does not specify the exact local interface or Bluetooth operations needed to trigger the race.

Which Ubuntu kernel packages are identified as affected?

The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-hwe-edge, ubuntu/linux-gke, and ubuntu/linux-gkeop.

What is the impact if the race is triggered?

Concurrent removal of the same command-synchronization entry can cause a double list_del() operation and a use-after-free condition. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability of the vulnerable system.

UBUNTU-CVE-2025-40318: High severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which Ubuntu kernel packages are identified as affected?

What is the impact if the race is triggered?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which Ubuntu kernel packages are identified as affected?

What is the impact if the race is triggered?