CVE-2025-38128
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38128
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38128.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-38128
- Downstream
- Published
- 2025-07-03T08:35:33Z
- Modified
- 2025-10-22T12:26:28.331855Z
- Summary
- Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: reject malformed HCICMDSYNC commands
In 'mgmthcicmdsync()', check whether the size of parameters passed in 'struct mgmtcphcicmdsync' matches the total size of the data (i.e. 'sizeof(struct mgmtcphcicmdsync)' plus trailing bytes). Otherwise, large invalid 'paramslen' will cause 'hcicmdsyncalloc()' to do 'skbputdata()' from an area beyond the one actually passed to 'mgmthcicmdsync()'.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced827af4787e74e8df9e8e0677a69fbb15e0856d2fFixed9eeafd16d76a7642d12b3442a26c15cd345e12f7
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced827af4787e74e8df9e8e0677a69fbb15e0856d2fFixed03f1700b9b4d4f2fed3165370f3c23db76553178