CVE-2025-40309 is a use-after-free vulnerability in the Linux kernel Bluetooth SCO connection code, specifically in the sco_conn_free function. The bug was detected by KASAN (Kernel Address Sanitizer) as a slab-use-after-free condition, indicating that memory was accessed after being freed. This could lead to memory corruption and potentially allow an attacker with local privileges to cause denial of service or escalate privileges. The vulnerability was fixed in the Linux kernel source, as indicated by the resolution note, but no explicit fixed kernel versions are provided in the input data.

The vulnerability allows for use-after-free memory corruption in the Bluetooth SCO connection handling code of the Linux kernel. This can lead to system instability, crashes, or potentially privilege escalation due to corrupted kernel memory. The CVSS vector indicates high impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should update their Linux kernel to a version that includes this fix once it is available from their distribution or vendor. Patch status is not yet confirmed with specific version numbers — check the official Linux kernel advisories or vendor advisories for current remediation guidance.