| { |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" |
| }, |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_uart: Fix another race during initialization\n\nDo not set 'HCI_UART_PROTO_READY' before call 'hci_uart_register_dev()'.\nPossible race is when someone calls 'hci_tty_uart_close()' after this bit\nis set, but 'hci_uart_register_dev()' wasn't done. This leads to access\nto uninitialized fields. To fix it let's set this bit after device was\nregistered (as before patch c411c62cc133) and to fix previous problem let's\nadd one more bit in addition to 'HCI_UART_PROTO_READY' which allows to\nperform power up without original bit set (pls see commit c411c62cc133).\n\nCrash backtrace from syzbot report:\n\nRIP: 0010:skb_queue_empty_lockless include/linux/skbuff.h:1887 [inline]\nRIP: 0010:skb_queue_purge_reason+0x6d/0x140 net/core/skbuff.c:3936\n\nCall Trace:\n <TASK>\n skb_queue_purge include/linux/skbuff.h:3364 [inline]\n mrvl_close+0x2f/0x90 drivers/bluetooth/hci_mrvl.c:100\n hci_uart_tty_close+0xb6/0x120 drivers/bluetooth/hci_ldisc.c:557\n tty_ldisc_close drivers/tty/tty_ldisc.c:455 [inline]\n tty_ldisc_kill+0x66/0xc0 drivers/tty/tty_ldisc.c:613\n tty_ldisc_release+0xc9/0x120 drivers/tty/tty_ldisc.c:781\n tty_release_struct+0x10/0x80 drivers/tty/tty_io.c:1690\n tty_release+0x4ef/0x640 drivers/tty/tty_io.c:1861\n __fput+0x86/0x2a0 fs/file_table.c:450\n task_work_run+0x82/0xb0 kernel/task_work.c:239\n resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]\n exit_to_user_mode_loop kernel/entry/common.c:114 [inline]\n exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]\n __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]\n syscall_exit_to_user_mode+0xa3/0x1b0 kernel/entry/common.c:218\n do_syscall_64+0x9a/0x190 arch/x86/entry/common.c:89\n entry_SYSCALL_64_after_hwframe+0x77/0x7f" |
| } |
| ], |
| "affected": [ |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "drivers/bluetooth/hci_ldisc.c", |
| "drivers/bluetooth/hci_uart.h" |
| ], |
| "versions": [ |
| { |
| "version": "48effdb7a798232db945503cf3f51e0be8070cea", |
| "lessThan": "1dcf08fcff5ca529de6dc0395091f28854f4e54a", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "45fa7bd82c6178f4fec0ab94891144a043ec5fe8", |
| "lessThan": "a40f94f7caa8d3421b64f63ac31bc0f24c890f39", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "d71a57a34ab6bbc95dc461158403c02e8ff3f912", |
| "lessThan": "9e5a0f5777162e503400c70c6ed25fbbe2d38799", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "9cf7dccaa7f4c56d2089700e5cb11f85a8d5f6cf", |
| "lessThan": "80f14e9de6a43a0bd8194cad1003a3e6dcbc3984", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "806464634e7fc6b523160defeeddb1ade2a72f81", |
| "lessThan": "02e1bcdfdf769974e7e9fa285e295cd9852e2a38", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "6b7a32fa9bacdebd98c18b2a56994116995ee643", |
| "lessThan": "281782d2c6730241e300d630bb9f200d831ede71", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "15543b7bbe7b5f744fdbb44f75b14f81a0117813", |
| "lessThan": "8e5aff600539e5faea294d9612cca50220e602b8", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "a4b89a45b12b69bc82c8137346b150a118e02c26", |
| "lessThan": "db7509fa110dd9b11134b75894677f30353b2c51", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "366ceff495f902182d42b6f41525c2474caf3f9a", |
| "lessThan": "5df5dafc171b90d0b8d51547a82657cd5a1986c7", |
| "status": "affected", |
| "versionType": "git" |
| } |
| ] |
| }, |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "drivers/bluetooth/hci_ldisc.c", |
| "drivers/bluetooth/hci_uart.h" |
| ] |
| } |
| ], |
| "cpeApplicability": [ |
| { |
| "nodes": [ |
| { |
| "operator": "OR", |
| "negate": false, |
| "cpeMatch": [] |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://git.kernel.org/stable/c/1dcf08fcff5ca529de6dc0395091f28854f4e54a" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/a40f94f7caa8d3421b64f63ac31bc0f24c890f39" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/9e5a0f5777162e503400c70c6ed25fbbe2d38799" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/80f14e9de6a43a0bd8194cad1003a3e6dcbc3984" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/02e1bcdfdf769974e7e9fa285e295cd9852e2a38" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/281782d2c6730241e300d630bb9f200d831ede71" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/8e5aff600539e5faea294d9612cca50220e602b8" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/db7509fa110dd9b11134b75894677f30353b2c51" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/5df5dafc171b90d0b8d51547a82657cd5a1986c7" |
| } |
| ], |
| "title": "Bluetooth: hci_uart: Fix another race during initialization", |
| "x_generator": { |
| "engine": "bippy-1.2.0" |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", |
| "cveID": "CVE-2025-23139", |
| "requesterUserId": "gregkh@kernel.org", |
| "serial": "1", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0" |
| } |
