CVE-2025-40141

Analysis

A use-after-free vulnerability exists in the Linux kernel's Bluetooth ISO (Isochronous) protocol implementation. The flaw occurs in the iso_conn_free function, where the conn->sk pointer (a socket reference) is not set to NULL after the associated socket is freed or released. This is analogous to a previously fixed issue in the SCO (Synchronous Connection-Oriented) protocol (sco_conn_free). If the freed socket is later accessed through the dangling conn->sk pointer, an attacker could trigger a use-after-free condition.

Exploitation

Exploitation requires that an attacker be able to trigger specific Bluetooth operations that cause the freeing of an ISO connection while the socket reference remains accessible. The vulnerability is local and would typically require the attacker to have the ability to interact with the Bluetooth stack, e.g., via unprivileged process access to Bluetooth sockets or crafted Bluetooth communication. No authentication is needed beyond local system access that allows Bluetooth operations.

Impact

A successful exploit could lead to a kernel crash (denial of service) or potentially allow an attacker to achieve arbitrary code execution in the kernel context, depending on how the freed memory is reallocated and controlled. The impact is consistent with typical use-after-free bugs in kernel subsystems.

Mitigation

Patches have been committed to the Linux kernel stable tree. The fix ensures that conn->sk is set to NULL in iso_conn_free, similar to the fix for SCO (git commit references [1] and [2]). Users and distributions are advised to update to a corrected kernel version as soon as possible.