CVE-2025-40294

A flaw was found in the Linux kernel's Bluetooth management (MGMT) subsystem. A local attacker could exploit an out-of-bounds (OOB) write vulnerability in the parse_adv_monitor_pattern() function. This occurs when user-controlled input for the length variable exceeds the buffer's capacity during a copy operation, potentially leading to information disclosure and a denial of service (DoS).

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation is confined to local authenticated users who have access to the kernel Bluetooth management subsystem. In typical enterprise server and cloud environments, Bluetooth hardware is not present or enabled, significantly minimizing exposure. Successful exploitation requires specific interaction with advertisement monitoring routines, which could allow a local attacker to cause a denial of service or access sensitive kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, the bluetooth kernel module can be prevented from loading. Create a file /etc/modprobe.d/disable-bluetooth.conf with the content blacklist bluetooth. Then, regenerate the initramfs using dracut -f -v and reboot the system for the changes to take effect. This mitigation will disable all Bluetooth functionality on the system.