Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2025-68305

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending before write iter sends the cmd, just as syzbot reported in UAF[1]. Here we use hci_dev_lock to synchronize the two, thereby avoiding the UAF mentioned in [1]. [1] syzbot reported: BUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:8223dcfaa2e6ef736a07d6db56f984d5e104e09bece5f5d6e85cd25533dbc55c
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/hci_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.119","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.61","versionType":"semver"},{"lessThanOrEqual":"6.17.*","status":"unaffected","version":"6.17.11","versionType":"semver"},{"lessTh…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:00321c4d9dd8008439db95456857df9eab413567e29301d18ff4af3fb74a80cd · sha256:7ff1a0e6e1655f65… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/hci_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fe68510fc99bb4b88c9c611f83699749002d515a","status":"affected","version":"bdd56875c6926d8009914f427df71797693e90d4","versionType":"git"},{"lessThan":"e90c05fc5bbea956450a05cc3b36b8fa29cf195e","status":"affected","version":"4e83f2dbb2bf677e614109df24426c4dded472d4","versionType":"git"},{"lessThan":"69fcb0344bc0dd5b13d7e4e98f8b6bf25a6d4ff7","status":"affected","version":"6fe26f694c824b8a4dbf5…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:00321c4d9dd8008439db95456857df9eab413567e29301d18ff4af3fb74a80cd · sha256:7ff1a0e6e1655f65… · /containers/cna/affected/0

Affected products and versions

2 source assertions
{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/hci_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.119","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.61","versionType":"semver"},{"lessThanOrEqual":"6.17.*","status":"unaffected","version":"6.17.11","versionType":"semver"},{"lessTh…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:00321c4d9dd8008439db95456857df9eab413567e29301d18ff4af3fb74a80cd · sha256:7ff1a0e6e1655f65… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/hci_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fe68510fc99bb4b88c9c611f83699749002d515a","status":"affected","version":"bdd56875c6926d8009914f427df71797693e90d4","versionType":"git"},{"lessThan":"e90c05fc5bbea956450a05cc3b36b8fa29cf195e","status":"affected","version":"4e83f2dbb2bf677e614109df24426c4dded472d4","versionType":"git"},{"lessThan":"69fcb0344bc0dd5b13d7e4e98f8b6bf25a6d4ff7","status":"affected","version":"6fe26f694c824b8a4dbf5…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:00321c4d9dd8008439db95456857df9eab413567e29301d18ff4af3fb74a80cd · sha256:7ff1a0e6e1655f65… · /containers/cna/affected/0

Source references

4 source assertions
{"url":"https://git.kernel.org/stable/c/69fcb0344bc0dd5b13d7e4e98f8b6bf25a6d4ff7"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:00321c4d9dd8008439db95456857df9eab413567e29301d18ff4af3fb74a80cd · sha256:7ff1a0e6e1655f65… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/89bb613511cc21ed5ba6bddc1c9b9ae9c0dad392"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:00321c4d9dd8008439db95456857df9eab413567e29301d18ff4af3fb74a80cd · sha256:7ff1a0e6e1655f65… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/e90c05fc5bbea956450a05cc3b36b8fa29cf195e"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:00321c4d9dd8008439db95456857df9eab413567e29301d18ff4af3fb74a80cd · sha256:7ff1a0e6e1655f65… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/fe68510fc99bb4b88c9c611f83699749002d515a"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:00321c4d9dd8008439db95456857df9eab413567e29301d18ff4af3fb74a80cd · sha256:7ff1a0e6e1655f65… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer