CVE-2025-40213
- Source
- https://cve.org/CVERecord?id=CVE-2025-40213
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40213.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-40213
- Downstream
AZL (1)
BELL (1)
DEBIAN (1)
openSUSE (1)
ROOT (1)
SUSE (13)
- Related
- Published
- 2025-11-24T15:59:44Z
- Modified
- 2026-10-22T02:47:46Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to memcpy from badly declared on-stack flexible array.
Another crash is in set_mesh_complete() due to double list_del via mgmt_pending_valid + mgmt_pending_remove.
Use DEFINE_FLEX to declare the flexible array right, and don't memcpy outside bounds.
As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free, and also report status on error.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40213.json" }- References
-
- https://git.kernel.org/stable/c/1c9aca1787e8395a2c59fef20e914467958969c5
- https://git.kernel.org/stable/c/31d6c9216aa1be18ba317239738f73b0b0c7b691
- https://git.kernel.org/stable/c/5c19daa93d9af29f1f46251b47e1ea66bcc8d679
- https://git.kernel.org/stable/c/e8785404de06a69d89dcdd1e9a0b6ea42dc6d327
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40213.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-40213
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0b60eb04b8524e1b4b3f07fea0d16fda9a677d9aFixed31d6c9216aa1be18ba317239738f73b0b0c7b691
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd71b98f253b079cbadc83266383f26fe7e9e103bFixed5c19daa93d9af29f1f46251b47e1ea66bcc8d679
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced302a1f674c00dd5581ab8e493ef44767c5101aabFixed1c9aca1787e8395a2c59fef20e914467958969c5Fixede8785404de06a69d89dcdd1e9a0b6ea42dc6d327
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.6.140Fixed6.6.160
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.16.10Fixed6.17
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced87a1f16f07c6c43771754075e08f45b41d237421