CVE-2025-39982

A flaw was found in the Linux kernel’s Bluetooth subsystem (HCI). Specifically, in the function hci_acl_create_conn_sync() (and related path hci_le_create_conn_sync()), a connection object in state BT_OPEN that is still pending command submission may be freed prematurely, leading to a use-after-free condition. An attacker with network privileges could exploit this to trigger memory corruption, a denial of service, or a potential escalation of privileges.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires an active Bluetooth controller and specific timing conditions during connection initialization. In standard enterprise server environments, Bluetooth hardware is typically absent and associated services are disabled by default, substantially restricting exposure. On systems where Bluetooth interfaces are actively used, an adjacent attacker could trigger the use-after-free condition to cause kernel instability or a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.