CVE-2025-39981

A flaw was found in the Linux kernel’s Bluetooth management subsystem (net/bluetooth/mgmt*.c). The mgmt_pending structure may be freed while still being processed, or remain on the pending command list, which allows a use-after-free or double-free scenario. An attacker with local access to the system and the ability to interact with the Bluetooth subsystem could exploit this to trigger memory corruption, potentially leading to elevated privileges or denial of service.

This flaw is rated as Moderate because exploitation requires local access and the capability to communicate with the kernel's Bluetooth management interface. Enterprise server environments rarely utilize Bluetooth hardware, and the subsystem is typically unconfigured or unused, substantially limiting attack exposure. While successful exploitation can cause memory corruption leading to a local denial of service or potential elevation of privileges, the issue cannot be exploited remotely.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Ensure Bluetooth management interfaces are hardened or, if unused, disabled.