VulnerabilityPublished 10 Jul 2025Updated 5 Nov 2026

CVE-2025-38315: Linux kernel · Bluetooth: btintel: Check dsbr size from EFI variable

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in 9427f6081f37c795a8bd29d0ee72a4da3bd64af8 : patch Linux kernel soon.

Data as of 5 Nov 2026, 21:34 UTC

Severity

High

Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in 9427f6081f37c795a8bd29d0ee72a4da3bd64af8, 7b8526bb489780ccc0caffc446ecabec83cfe568, 3aa1dc3c9060e335e82e9c182bf3d1db29220b1b

Exploitation evidence

Disclosed: evidence found.
CVE published 10 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to 9427f6081f37c795a8bd29d0ee72a4da3bd64af8, 7b8526bb489780ccc0caffc446ecabec83cfe568 or 3aa1dc3c9060e335e82e9c182bf3d1db29220b1b.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ eb9e749c0182affafadfbe5ded4503c4b5a9b57c, < 9427f6081f37c795a8bd29d0ee72a4da3bd64af8	Fixed in 9427f6081f37c795a8bd29d0ee72a4da3bd64af8
LinuxLinux	Affected ≥ eb9e749c0182affafadfbe5ded4503c4b5a9b57c, < 7b8526bb489780ccc0caffc446ecabec83cfe568	Fixed in 7b8526bb489780ccc0caffc446ecabec83cfe568
LinuxLinux	Affected ≥ eb9e749c0182affafadfbe5ded4503c4b5a9b57c, < 3aa1dc3c9060e335e82e9c182bf3d1db29220b1b	Fixed in 3aa1dc3c9060e335e82e9c182bf3d1db29220b1b
LinuxLinux	Affected =6.11	Fixed in–

AI-suggested

A fix is available and has been applied in the Linux kernel source code. Users and administrators should update to a Linux kernel version that includes the fix (post-6.11 with the specified commits). No additional mitigation steps are indicated by the vendor.

Description

A stack buffer overflow vulnerability was identified and fixed in the Linux kernel Bluetooth component (btintel). The flaw occurred because the code did not properly verify the size of an EFI variable against the expected size of the struct btintel_dsbr, leading to potential overflow when the EFI variable was larger. The fix involves checking the EFI variable size against the known struct size and failing if they do not match.

Impact

The vulnerability could lead to a stack buffer overflow in the Bluetooth subsystem of the Linux kernel, potentially allowing an attacker to cause memory corruption. However, no known exploits in the wild have been reported. The impact is limited to affected Linux kernel versions with the vulnerable Bluetooth driver.

Summary

CVE-2025-38315 is a vulnerability in the Linux kernel's Bluetooth btintel driver where a stack buffer overflow could occur due to improper size checking of an EFI variable. The vulnerability arises when the EFI variable size exceeds the size of the struct btintel_dsbr, which was not correctly validated before use. The patch changes the code to start with the known size of struct btintel_dsbr and verify that the EFI variable size matches this expectation, preventing overflow. This issue affects Linux kernel version 6.11 and was fixed in subsequent commits.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Nov 2026, 21:34 UTC

Technical details

References

Community reviews

Related threats