CVE-2025-40284 addresses a vulnerability in the Linux kernel's Bluetooth mesh management where the mesh_send_done timer was not canceled upon removal of the Bluetooth device (hdev). This oversight could lead to a use-after-free condition causing kernel crashes when the timer triggers after the device is freed. The fix involves canceling the timer during device removal, aligning with the handling of other MGMT timers. The issue was detected by the BlueZ test bot and is evidenced by KASAN slab-use-after-free errors in kernel logs.

The vulnerability can cause a kernel crash (denial of service) due to a use-after-free condition in the Bluetooth mesh management subsystem. This affects system stability and could potentially be leveraged to escalate privileges or disrupt Bluetooth functionality. The CVSS vector indicates local attack complexity with low privileges required and no user interaction, with high impact on confidentiality, integrity, and availability.

A fix has been implemented in the Linux kernel to cancel the mesh send timer when the Bluetooth device is removed. Users should update to a kernel version that includes this fix once available. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply them accordingly.