CVE-2025-38303

Vulnerability

The Bluetooth Extended Inquiry Response (EIR) subsystem in the Linux kernel contains a flaw in the eir_create_adv_data function. This function may attempt to add EIR_FLAGS and EIR_TX_POWER data types without first verifying that there is sufficient space in the buffer. If the buffer is too small, this can lead to a memory corruption or a crash.

Exploitation

An attacker could potentially trigger this vulnerability by crafting a malicious Bluetooth advertisement that forces the system to construct an EIR response with insufficient buffer capacity. The attack requires the ability to send Bluetooth advertisements to a vulnerable device, which may be possible from a nearby unauthenticated device.

Impact

Successful exploitation could cause a denial of service (system crash) on the target. The CVSS v3 score of 5.5 (Medium) reflects the potential for local or adjacent network attacks to cause a crash, but not arbitrary code execution.

Mitigation

Patches are available in the Linux kernel stable repository (commits [1] and [2]). Users should update to a kernel version containing these fixes to prevent the crash.

[1]: https://git.kernel.org/stable/c/2af40d795d3fb0ee5c074b7ac56ab22402aa6e4f [2]: https://git.kernel.org/stable/c/2d4588f55cc10fc228f3b46469dbfb3f0a8b13c8