CVE-2025-40318High· 8.8▾ Twilight

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhil…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score48/ 100 · Moderate

impact 48.4 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Dec 8, 2025

Updated

Oct 14, 2026

CVSS

8.8

Vendor

—

Product

—

CWE

—

Depth score

48 · Moderate

EPSS

0.27% · p18

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 310 days

Dec 8, 2025Published
Disclosed via NVD
Oct 14, 2026Record revised
Last analysed / modified upstream
Oct 14, 2026EPSS first tracked
0.3%

#nvd

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once

hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF".

Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References