CVE-2025-38315

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: Check dsbr size from EFI variable

Since the size of struct btintel_dsbr is already known, we can just start there instead of querying the EFI variable size. If the final result doesn't match what we expect also fail. This fixes a stack buffer overflow when the EFI variable is larger than struct btintel_dsbr.

In the Intel Bluetooth driver (btintel.c), the function btintel_uefi_get_dsbr() queries a UEFI variable without enforcing a size limit. If the UEFI variable is larger than expected, this leads to a stack buffer overflow when copying data into a fixed-size stack structure. The patch fixes this by initializing data_size to sizeof(data) and verifying that the retrieved size exactly matches. The privileges required are High because accessing or modifying EFI variables typically requires root privileges or physical access to the system firmware. Normal userspace applications cannot directly read or overwrite EFI NVRAM entries without elevated permissions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.