CVE-2025-40213

HighCVSS 7.8/10Last modified Oct 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete

There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to memcpy from badly declared on-stack flexible array.

Another crash is in set_mesh_complete() due to double list_del via mgmt_pending_valid + mgmt_pending_remove.

Use DEFINE_FLEX to declare the flexible array right, and don't memcpy outside bounds.

As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free, and also report status on error.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
LinuxLinux>= 0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a, < 31d6c9216aa1be18ba317239738f73b0b0c7b691; >= d71b98f253b079cbadc83266383f26fe7e9e103b, < 5c19daa93d9af29f1f46251b47e1ea66bcc8d679; >= 302a1f674c00dd5581ab8e493ef44767c5101aab, < 1c9aca1787e8395a2c59fef20e914467958969c5; >= 302a1f674c00dd5581ab8e493ef44767c5101aab, < e8785404de06a69d89dcdd1e9a0b6ea42dc6d327; 87a1f16f07c6c43771754075e08f45b41d237421; >= 6.6.140, < 6.6.160; >= 6.16.10, < 6.17
LinuxLinux6.17

References

Timeline

Published
Nov 24, 2025
Last modified
Oct 21, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-402147.8In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge(). Quang Le reported thCVE-2025-402157.8In the Linux kernel, the following vulnerability has been resolved: xfrm: delete x->tunnel as we delete x The ipcomp fallback tunnels currCVE-2025-402167.8In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: don't rely on user vaddr alignment There is no guaranteCVE-2025-40217In the Linux kernel, the following vulnerability has been resolved: pidfs: validate extensible ioctls Validate extensible ioctls stricter CVE-2025-40218In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success DAMOCVE-2025-40219In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Commit 057CVE-2025-40228.8A vulnerability was found in web-arena-x webarena up to 0.2.0. It has been declared as critical. This vulnerability affects the function HTMCVE-2025-40220In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fuseblk workers I obseCVE-2025-40221In the Linux kernel, the following vulnerability has been resolved: media: pci: mg4b: fix uninitialized iio scan data Fix potential leak oCVE-2025-40222In the Linux kernel, the following vulnerability has been resolved: tty: serial: sh-sci: fix RSCI FIFO overrun handling The receive error CVE-2025-40223In the Linux kernel, the following vulnerability has been resolved: most: usb: Fix use-after-free in hdm_disconnect hdm_disconnect() callsCVE-2025-40224In the Linux kernel, the following vulnerability has been resolved: hwmon: (cgbc-hwmon) Add missing NULL check after devm_kzalloc() The dr
CVE-2025-40213: High severity, CVSS 7.8 | Vulnix