CVE-2025-40301

A flaw was found in the Linux kernel's Bluetooth component. A local attacker with low privileges could exploit a vulnerability in the Host Controller Interface (HCI) event processing. This issue arises from improper handling of command complete events with unknown opcodes, which can lead to the system attempting to read from uninitialized memory. Successful exploitation could result in the disclosure of sensitive information or cause the system to become unavailable (a denial of service).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the Bluetooth kernel module if Bluetooth functionality is not required. This can be achieved by blacklisting the bluetooth module. Create a file named /etc/modprobe.d/disable-bluetooth.conf with the following content: blacklist bluetooth. A system reboot is required for this change to take effect. Disabling Bluetooth may impact functionality that relies on Bluetooth connectivity.