In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once… (CVE-2025-40318)
A race condition vulnerability in the Linux kernel Bluetooth subsystem (hci_sync) has been resolved. The issue occurs in the function hci_cmd_sync_dequeue_once(), where lookup and cancellation of an entry happen under separate locks, while another function, hci_cmd_sync_work(), can concurrently delete the same entry. This leads to a double list deletion and use-after-free (UAF) condition. The fix involves holding the cmd_sync_work_lock across both lookup and cancel operations to prevent concurrent removal of the entry.
AI Analysis
Technical Summary
CVE-2025-40318 describes a race condition in the Linux kernel Bluetooth component involving the hci_cmd_sync_dequeue_once() function. The vulnerability arises because the function performs lookup and cancellation of an entry under two separate lock sections, while concurrently, hci_cmd_sync_work() may delete the same entry. This concurrency issue leads to a double list_del() operation and a use-after-free condition. The patch fixes this by ensuring the cmd_sync_work_lock is held during both lookup and cancellation, preventing concurrent deletion and eliminating the race.
Potential Impact
Successful exploitation of this vulnerability could lead to use-after-free conditions in the Linux kernel Bluetooth stack, potentially causing system crashes or allowing an attacker to execute arbitrary code with kernel privileges. The CVSS 3.1 vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H).
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications and apply updates promptly once released. No specific workaround is detailed in the provided information.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once… (CVE-2025-40318)
Description
A race condition vulnerability in the Linux kernel Bluetooth subsystem (hci_sync) has been resolved. The issue occurs in the function hci_cmd_sync_dequeue_once(), where lookup and cancellation of an entry happen under separate locks, while another function, hci_cmd_sync_work(), can concurrently delete the same entry. This leads to a double list deletion and use-after-free (UAF) condition. The fix involves holding the cmd_sync_work_lock across both lookup and cancel operations to prevent concurrent removal of the entry.
CVSS v3.1
Score 8.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-40318 describes a race condition in the Linux kernel Bluetooth component involving the hci_cmd_sync_dequeue_once() function. The vulnerability arises because the function performs lookup and cancellation of an entry under two separate lock sections, while concurrently, hci_cmd_sync_work() may delete the same entry. This concurrency issue leads to a double list_del() operation and a use-after-free condition. The patch fixes this by ensuring the cmd_sync_work_lock is held during both lookup and cancellation, preventing concurrent deletion and eliminating the race.
Potential Impact
Successful exploitation of this vulnerability could lead to use-after-free conditions in the Linux kernel Bluetooth stack, potentially causing system crashes or allowing an attacker to execute arbitrary code with kernel privileges. The CVSS 3.1 vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H).
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications and apply updates promptly once released. No specific workaround is detailed in the provided information.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-m8vr-v3r8-7vqf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-40318"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d49c2644c7f8479217
Added to database: 07/30/2026, 15:50:44 UTC
Last enriched: 07/30/2026, 17:53:07 UTC
Last updated: 09/10/2026, 19:38:49 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.