CVE-2025-38118

A flaw was found in the Linux kernel's Bluetooth Management (MGMT) subsystem. A local attacker with low privileges could exploit a use-after-free (UAF) vulnerability by performing a specific Bluetooth management operation. This flaw occurs because the operation incorrectly handles memory, which may lead to a system crash (Denial of Service) or potentially allow for privilege escalation or arbitrary code execution.

A MODERATE impact use-after-free flaw was found in the Linux kernel's Bluetooth Management (MGMT) subsystem as shipped in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat In-Vehicle OS. When processing the MGMT_OP_REMOVE_ADV_MONITOR command, the kernel tracked the operation with a pending-command entry that could be freed (for example when a Bluetooth HCI socket is bound and the adapter index is removed) while the removal completion callback mgmt_remove_adv_monitor_complete still accessed it, resulting in a slab use-after-free. A local attacker with low privileges able to perform Bluetooth management operations could exploit this to crash the system (denial of service) or potentially escalate privileges or execute arbitrary code. Red Hat assessed the practical impact as availability only and scored the flaw CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than the 7.8 severity assigned by NIST and CVE.org, whose scoring also credits confidentiality and integrity impact. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those streams. For the affected streams the fix is currently deferred, so the vulnerable code remains and the residual risk is exploitation by an unprivileged local user with access to Bluetooth management operations, most realistically causing a system crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.