CVE-2025-38592 – A use-after-free vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2025-38592?

CVE-2025-38592 has a CVSS score of 7.1 (HIGH). A use-after-free vulnerability in the Linux kernel's Bluetooth subsystem allows local attackers to cause memory corruption and potentially crash the kernel. This affects systems with Bluetooth functionality enabled and requires local access to trigger. The vulnerability occurs when device coredump handling frees a buffer that is still being accessed.

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's Bluetooth subsystem allows local attackers to cause memory corruption and potentially crash the kernel. This affects systems with Bluetooth functionality enabled and requires local access to trigger. The vulnerability occurs when device coredump handling frees a buffer that is still being accessed.

💻 Affected Systems

Products:

Linux Kernel

Versions: Specific affected versions not specified in CVE, but patches exist for stable branches. Likely affects versions before the fix commits.

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Bluetooth functionality enabled. The vulnerability is triggered during device coredump timeout handling.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, with potential for local privilege escalation if combined with other vulnerabilities.

🟠

Likely Case

System crash or kernel panic causing denial of service on affected Bluetooth-enabled systems.

🟢

If Mitigated

No impact if Bluetooth is disabled or the system is patched.

🌐 Internet-Facing: LOW - Requires local access to exploit, not remotely exploitable.

🏢 Internal Only: MEDIUM - Local attackers or malicious processes could trigger the vulnerability to cause system instability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and triggering specific Bluetooth coredump conditions. The vulnerability was discovered via syzbot fuzzing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patched in kernel commits: 7af4d7b53502286c6cf946d397ab183e76d14820, 8c021ad797f9171d015cf0a932a3fbe5232190f5, efd55f6a59449f8d4e4953f12c177aa902b7451f

Vendor Advisory: https://git.kernel.org/stable/c/7af4d7b53502286c6cf946d397ab183e76d14820

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check with your distribution for security updates. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable Bluetooth

linux

Disable Bluetooth functionality to prevent the vulnerable code path from being triggered.

sudo systemctl stop bluetooth
sudo systemctl disable bluetooth
sudo rfkill block bluetooth

🧯 If You Can't Patch

Disable Bluetooth functionality completely
Implement strict access controls to prevent local users from triggering Bluetooth coredump operations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if Bluetooth is enabled. Vulnerable if running unpatched kernel with Bluetooth active.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits or check with 'uname -r' after updating to patched kernel version.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
KASAN reports of vmalloc-out-of-bounds errors
Bluetooth subsystem crashes

Network Indicators:

None - local vulnerability only

SIEM Query:

Search for kernel panic logs or KASAN reports mentioning 'hci_devcd_dump', 'skb_put_data', or 'vmalloc-out-of-bounds'

📊 Metadata

CVE ID: CVE-2025-38592

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

EPSS Score: 0.01% exploit probability (1.7th percentile)

Published: August 19, 2025

Last Updated: November 26, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-38592, you might also want to check these: