In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate skb length for unknown CC opcode In… (CVE-2025-40301)
A vulnerability in the Linux kernel Bluetooth subsystem was resolved involving improper validation of skb length when handling unknown command complete opcodes. The function hci_cmd_complete_evt() assumed the presence of return status data without verifying skb length, potentially leading to use of uninitialized memory. The fix involves checking skb length before accessing skb data to prevent this issue.
AI Analysis
Technical Summary
The Linux kernel Bluetooth component had a vulnerability in the hci_cmd_complete_evt() function where, if a command complete event contained an unknown opcode, the code assumed the first byte of skb->data contained the return status. However, since parameter data might have been previously pulled, skb could be empty, causing the code to read uninitialized memory. The vulnerability was fixed by adding a check on skb->len before accessing skb->data.
Potential Impact
This vulnerability can lead to reading uninitialized memory, which may cause information disclosure (confidentiality impact), modification of memory (integrity impact), and potentially denial of service (availability impact) due to kernel instability. The CVSS vector indicates the attack requires adjacent network access with low complexity and no privileges or user interaction, making it a high-severity issue.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to validate skb length before accessing skb->data in the Bluetooth hci_event code. Users and administrators should apply the official Linux kernel updates that include this patch. Since no patch links are provided here, consult the Linux kernel vendor advisories or mainline kernel repositories for the official fix.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate skb length for unknown CC opcode In… (CVE-2025-40301)
Description
A vulnerability in the Linux kernel Bluetooth subsystem was resolved involving improper validation of skb length when handling unknown command complete opcodes. The function hci_cmd_complete_evt() assumed the presence of return status data without verifying skb length, potentially leading to use of uninitialized memory. The fix involves checking skb length before accessing skb data to prevent this issue.
CVSS v3.1
Score 7.6high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel Bluetooth component had a vulnerability in the hci_cmd_complete_evt() function where, if a command complete event contained an unknown opcode, the code assumed the first byte of skb->data contained the return status. However, since parameter data might have been previously pulled, skb could be empty, causing the code to read uninitialized memory. The vulnerability was fixed by adding a check on skb->len before accessing skb->data.
Potential Impact
This vulnerability can lead to reading uninitialized memory, which may cause information disclosure (confidentiality impact), modification of memory (integrity impact), and potentially denial of service (availability impact) due to kernel instability. The CVSS vector indicates the attack requires adjacent network access with low complexity and no privileges or user interaction, making it a high-severity issue.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to validate skb length before accessing skb->data in the Bluetooth hci_event code. Users and administrators should apply the official Linux kernel updates that include this patch. Since no patch links are provided here, consult the Linux kernel vendor advisories or mainline kernel repositories for the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mp66-rx49-f278
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-40301"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d49c2644c7f8479252
Added to database: 07/30/2026, 15:50:44 UTC
Last enriched: 07/30/2026, 17:52:15 UTC
Last updated: 09/10/2026, 19:38:46 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.