CVE-2025-38304 – A NULL pointer dereference vulnerability exists... (How to Fix)

Q: What is the severity of CVE-2025-38304?

CVE-2025-38304 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability exists in the Linux kernel's Bluetooth subsystem within the eir_get_service_data function. This vulnerability can cause kernel panics or system crashes when processing malformed Bluetooth Extended Inquiry Response (EIR) data. Systems with Bluetooth enabled and running affected Linux kernel versions are vulnerable.

📋 TL;DR

A NULL pointer dereference vulnerability exists in the Linux kernel's Bluetooth subsystem within the eir_get_service_data function. This vulnerability can cause kernel panics or system crashes when processing malformed Bluetooth Extended Inquiry Response (EIR) data. Systems with Bluetooth enabled and running affected Linux kernel versions are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE, but patches exist in stable kernel trees. Likely affects multiple recent versions before fixes.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Bluetooth functionality enabled and kernel compiled with Bluetooth support.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially causing data loss or service disruption.

🟠

Likely Case

System crash or instability when processing malformed Bluetooth packets from nearby devices.

🟢

If Mitigated

Minimal impact if Bluetooth is disabled or proper access controls prevent malicious devices from connecting.

🌐 Internet-Facing: LOW - Bluetooth is short-range wireless, not directly internet-accessible.

🏢 Internal Only: MEDIUM - Requires physical proximity or internal network access to Bluetooth-enabled devices.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires sending malformed Bluetooth packets to a vulnerable system, which typically requires physical proximity or network access to Bluetooth range.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel trees (commits: 20a2aa01f5aeb6daad9aeaa7c33dd512c58d81eb, 497c9d2d7d3983826bb02c10fb4a5818be6550fb, 4bf29910570666e668a60d953f8da78e95bb7fa2, 7d99cc0f8e6fa0f35570887899f178122a61d44e, 842f7c3154d5b25ca11753c02ee8cf6ee64c0142)

Vendor Advisory: https://git.kernel.org/stable/c/20a2aa01f5aeb6daad9aeaa7c33dd512c58d81eb

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable Bluetooth

linux

Completely disable Bluetooth functionality to prevent exploitation.

sudo systemctl stop bluetooth
sudo systemctl disable bluetooth
sudo rfkill block bluetooth

Restrict Bluetooth Access

linux

Configure Bluetooth to reject connections from unauthorized devices.

sudo btmgmt -i hci0 block
sudo hciconfig hci0 noscan

🧯 If You Can't Patch

Disable Bluetooth on all affected systems immediately
Implement network segmentation to isolate Bluetooth-enabled devices from critical systems

🔍 How to Verify

Check if Vulnerable:

Check if Bluetooth is enabled and kernel version is unpatched: 'systemctl status bluetooth' and 'uname -r'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version after update matches patched version and Bluetooth functions normally: 'uname -r' and test Bluetooth connectivity

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
Bluetooth subsystem crash logs
System reboot events without clear cause

Network Indicators:

Unusual Bluetooth connection attempts from unknown devices
Malformed Bluetooth packet patterns

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "NULL pointer dereference") AND "bluetooth"

📊 Metadata

CVE ID: CVE-2025-38304

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.02% exploit probability (4.3th percentile)

Published: July 10, 2025

Last Updated: December 19, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-38304, you might also want to check these: