CVE-2025-40282
Description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local header for RX skb, otherwise things crash, eg. with AF_PACKET SOCK_RAW
Add missing skb_reset_mac_header() for uncompressed ipv6 RX path.
For the compressed one, it is done in lowpan_header_decompress().
Log: (BlueZ 6lowpan-tester Client Recv Raw - Success) ------ kernel BUG at net/core/skbuff.c:212! Call Trace:
... packet_rcv (net/packet/af_packet.c:2152) ...
__local_bh_enable_ip (kernel/softirq.c:407) netif_rx (net/core/dev.c:5648) chan_recv_cb (net/bluetooth/6lowpan.c:294 net/bluetooth/6lowpan.c:359) ------
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Missing skb_reset_mac_header() in Bluetooth 6lowpan uncompressed IPv6 receive path causes kernel BUG on AF_PACKET raw socket recv.
Root
Cause
The Bluetooth 6lowpan netdev has header_ops defined, but the receive path for uncompressed IPv6 packets failed to call skb_reset_mac_header(). This omission causes a kernel BUG in packet_rcv() when an AF_PACKET raw socket receives the skb, as the link-layer header is not properly initialized [1][2][3][4].
Exploitation
An attacker with the ability to send Bluetooth 6lowpan packets over the air can trigger the bug. No authentication is required; simply sending a crafted uncompressed IPv6 packet to a device with the Bluetooth 6lowpan interface active leads to a crash. The issue manifests when a raw socket (SOCK_RAW) is listening on the interface, though the crash occurs regardless of socket creation.
Impact
Successful exploitation causes a kernel BUG, leading to a system denial of service (crash). This can be used to disrupt Bluetooth-enabled devices or as part of a broader attack chain.
Mitigation
The fix has been applied in stable kernel commits [1][2][3][4]. Users should update their Linux kernel to a version including these patches.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
3Patches
8ea46a1d217bc973e0271754cd566e9a2bfc84ebb90c3c309c24ac6cfe4f911cd7e06838170d84e7c3a443b78f5091827Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
8- git.kernel.org/stable/c/11cd7e068381666f842ad41d1cc58eecd0c75237nvd
- git.kernel.org/stable/c/3b78f50918276ab28fb22eac9aa49401ac436a3bnvd
- git.kernel.org/stable/c/4ebb90c3c309e6375dc3e841af92e2a039843e62nvd
- git.kernel.org/stable/c/70d84e7c3a44b81020a3c3d650a64c63593405bdnvd
- git.kernel.org/stable/c/973e0271754c77db3e1b6b69adf2de85a79a4c8bnvd
- git.kernel.org/stable/c/c24ac6cfe4f9a47180a65592c47e7a310d2f9d93nvd
- git.kernel.org/stable/c/d566e9a2bfc848941b091ffd5f4e12c4e889d818nvd
- git.kernel.org/stable/c/ea46a1d217bc82e01cf3d0424e50ebfe251e34bfnvd
News mentions
0No linked articles in our index yet.