CVE-2025-40301

Vulnerability

In hci_cmd_complete_evt(), when a command complete event has an unknown opcode, the code assumes the first byte of the remaining skb->data contains the return status. However, parameter data has already been pulled by hci_event_func(), which may leave the skb empty [1]. Reading skb->data[0] in this case accesses uninitialized memory.

Exploitation

The vulnerability is triggered when a Bluetooth controller sends a command complete event with an opcode not recognized by the kernel. No authentication is required, but an attacker would need to be able to inject such events, typically requiring local access or proximity to the device (Bluetooth range). The issue exists in the HCI event processing code path.

Impact

An attacker could cause the kernel to read uninitialized memory, potentially leading to information disclosure or system instability. The out-of-bounds read occurs before the command status is properly handled.

Mitigation

The fix, included in commit 5c5f1f64681c (stable backport fea895de78d3 in a different context [2]), adds a length check on skb->len before using skb->data. This ensures the skb has at least one byte of data, returning an error if not. Users should update to a kernel version containing this patch.