Search: CVE-2025-38250

A use-after-free vulnerability in the Linux kernel Bluetooth subsystem (vhci_flush function) has been resolved. The flaw occurs due to lack of proper synchronization when unlinking a Bluetooth device from the device list, potentially allowing concurrent access to freed memory. This issue was reported by syzbot and involves race conditions during device release and ioctl operations. The vulnerability affects multiple Linux kernel versions and has been assigned CVE-2025-38250 with a CVSS score of 7.8. A patch is available to fix the synchronization problem using SRCU mechanisms.