CVE-2025-40283

HighCVSS 7.8/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF

There is a KASAN: slab-use-after-free read in btusb_disconnect(). Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will free the btusb data associated with the interface. The same data is then used later in the function, hence the UAF.

Fix by moving the accesses to btusb data to before the data is free'd.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Dec 6, 2025
Last modified
Oct 15, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-402847.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: cancel mesh send timer when hdev removed mesh_send_doCVE-2025-402857.5In the Linux kernel, the following vulnerability has been resolved: smb/server: fix possible refcount leak in smb2_sess_setup() Reference CVE-2025-40286In the Linux kernel, the following vulnerability has been resolved: smb/server: fix possible memory leak in smb2_read() Memory leak occursCVE-2025-40287In the Linux kernel, the following vulnerability has been resolved: exfat: fix improper check of dentry.stream.valid_size We found an infiCVE-2025-40288In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices CVE-2025-40289In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM Otherwise CVE-2025-40297.8A vulnerability was found in code-projects Personal Diary Management System 1.0 and classified as critical. Affected by this issue is the fuCVE-2025-402907.8In the Linux kernel, the following vulnerability has been resolved: xsk: avoid data corruption on cq descriptor number Since commit 30f241CVE-2025-402917.8In the Linux kernel, the following vulnerability has been resolved: io_uring: fix regbuf vector size truncation There is a report of io_esCVE-2025-402928.4In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix received length check in big packets Since commit 4959CVE-2025-40293In the Linux kernel, the following vulnerability has been resolved: iommufd: Don't overflow during division for dirty tracking If pgshift CVE-2025-40294In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the
CVE-2025-40283: High severity, CVSS 7.8 | Vulnix