CVE-2025-40282

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Bluetooth 6lowpan implementation within the Linux kernel. Specifically, the code lacks proper handling of link-local headers during the reception of IPv6 packets, potentially leading to system crashes. The issue resides in the net/bluetooth/6lowpan.c file, where the netdev structure has header operations, requiring the setting of a link-local header for received skb packets. The absence of skb reset mac header() for the uncompressed IPv6 receive path causes the crash. This is addressed in the compressed path by lowpan header decompress(). The issue was observed during testing with BlueZ 6lowpan-tester. The vulnerable code is located in the chan recv cb function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.