CVE-2025-38117

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.15.0-rc7

Description: A vulnerability in the Linux kernel's Bluetooth management has been resolved by protecting the mgmt pending list with its own lock, preventing crashes due to concurrent access. The issue could cause slab-use-after-free errors, as seen in the hci sock get channel function.

Recommendations: For Linux kernel versions prior to 6.15.0-rc7, update to a version that includes the fix for the Bluetooth MGMT vulnerability. As a temporary workaround, consider disabling Bluetooth functionality until a patch is available. Restrict access to the mgmt pending list to minimize the risk of exploitation. Avoid using the hci sock get channel function in the affected API endpoint until the issue is resolved.