CVE-2025-40284

A use-after-free vulnerability exists in the Bluetooth MGMT subsystem of the Linux kernel. When a Bluetooth HCI device is removed, the mesh_send_done timer is not cancelled. If this timer fires after the device is freed, it accesses freed memory and causes a kernel crash.

Bluetooth mesh functionality must be in use, and device removal must occur while a mesh send operation is pending. This is a timing-dependent issue primarily observed during testing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.