{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-71082", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:30:19.648Z", "datePublished": "2026-01-13T15:34:46.301Z", "dateUpdated": "2026-08-05T12:11:56.554Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:11:56.554Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: revert use of devm_kzalloc in btusb\n\nThis reverts commit 98921dbd00c4e (\"Bluetooth: Use devm_kzalloc in\nbtusb.c file\").\n\nIn btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This\nties the lifetime of all the btusb data to the binding of a driver to\none interface, INTF. In a driver that binds to other interfaces, ISOC\nand DIAG, this is an accident waiting to happen.\n\nThe issue is revealed in btusb_disconnect(), where calling\nusb_driver_release_interface(&btusb_driver, data->intf) will have devm\nfree the data that is also being used by the other interfaces of the\ndriver that may not be released yet.\n\nTo fix this, revert the use of devm and go back to freeing memory\nexplicitly." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - A local process with write access to the USB device node can use USBFS ioctls to disconnect a chosen btusb sibling interface; Bluetooth radio packets do not directly reach this teardown path.\nAC:L - The attacker can select the sibling interface and synchronously initiate unbinding, controlling the harmful teardown order without winning an uncontrollable race.\nPR:L - A basic local user with delegated write access to the USB device node is sufficient because the USBFS disconnect path contains no capability check.\nUI:N - The attacker can issue the disconnect ioctl directly without any action by another user.\nS:U - The use-after-free compromises the host kernel within the same security authority and does not inherently cross a VM or IOMMU boundary.\nC:H - The freed shared btusb object contains numerous kernel pointers, anchors, and callback pointers; reclaiming it can provide powerful disclosure primitives.\nI:H - Reuse of the freed object can corrupt pointer-rich kernel state or redirect callback execution, making arbitrary kernel modification or code execution defensible.\nA:H - The use-after-free can cause a kernel oops or panic during interface teardown and can be triggered repeatedly." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/bluetooth/btusb.c" ], "versions": [ { "version": "98921dbd00c4e2e4bdd56423cb5edf98d57b45f7", "lessThan": "fff9206b0907252a41eb12b7c1407b9347df18b1", "status": "affected", "versionType": "git" }, { "version": "98921dbd00c4e2e4bdd56423cb5edf98d57b45f7", "lessThan": "cca0e9206e3bcc63cd3e72193e60149165d493cc", "status": "affected", "versionType": "git" }, { "version": "98921dbd00c4e2e4bdd56423cb5edf98d57b45f7", "lessThan": "c0ecb3e4451fe94f4315e6d09c4046dfbc42090b", "status": "affected", "versionType": "git" }, { "version": "98921dbd00c4e2e4bdd56423cb5edf98d57b45f7", "lessThan": "1e54c19eaf84ba652c4e376571093e58e144b339", "status": "affected", "versionType": "git" }, { "version": "98921dbd00c4e2e4bdd56423cb5edf98d57b45f7", "lessThan": "fdf7c640fb8a44a59b0671143d8c2f738bc48003", "status": "affected", "versionType": "git" }, { "version": "98921dbd00c4e2e4bdd56423cb5edf98d57b45f7", "lessThan": "252714f1e8bdd542025b16321c790458014d6880", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/bluetooth/btusb.c" ], "versions": [ { "version": "3.7", "status": "affected" }, { "version": "0", "lessThan": "3.7", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.198", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.160", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.120", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.64", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.4", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.15.198" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.1.160" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.6.120" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.12.64" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.18.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.19" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/fff9206b0907252a41eb12b7c1407b9347df18b1" }, { "url": "https://git.kernel.org/stable/c/cca0e9206e3bcc63cd3e72193e60149165d493cc" }, { "url": "https://git.kernel.org/stable/c/c0ecb3e4451fe94f4315e6d09c4046dfbc42090b" }, { "url": "https://git.kernel.org/stable/c/1e54c19eaf84ba652c4e376571093e58e144b339" }, { "url": "https://git.kernel.org/stable/c/fdf7c640fb8a44a59b0671143d8c2f738bc48003" }, { "url": "https://git.kernel.org/stable/c/252714f1e8bdd542025b16321c790458014d6880" } ], "title": "Bluetooth: btusb: revert use of devm_kzalloc in btusb", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2025-71082", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2026-06-10T20:41:23.595912Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T18:44:11.870Z" } } ] } }