{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2025-38592", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-38592", "idYear": 2025, "status": "PUBLISHED", "publishedAt": "2025-08-19T17:03:18.229Z", "updatedAt": "2026-08-05T12:03:13.863Z", "importedAt": "2026-10-24T01:57:34.152Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv\n\nCurrently both dev_coredumpv and skb_put_data in hci_devcd_dump use\nhdev->dump.head. However, dev_coredumpv can free the buffer. From\ndev_coredumpm_timeout documentation, which is used by dev_coredumpv:\n\n > Creates a new device coredump for the given device. If a previous one hasn't\n > been read yet, the new coredump is discarded. The data lifetime is determined\n > by the device coredump framework and when it is no longer needed the @free\n > function will be called to free the data.\n\nIf the data has not been read by the userspace yet, dev_coredumpv will\ndiscard new buffer, freeing hdev->dump.head. This leads to\nvmalloc-out-of-bounds error when skb_put_data tries to access\nhdev->dump.head.\n\nA crash report from syzbot illustrates this:\n\n ==================================================================\n BUG: KASAN: vmalloc-out-of-bounds in skb_put_data\n include/linux/skbuff.h:2752 [inline]\n BUG: KASAN: vmalloc-out-of-bounds in hci_devcd_dump+0x142/0x240\n net/bluetooth/coredump.c:258\n Read of size 140 at addr ffffc90004ed5000 by task kworker/u9:2/5844\n\n CPU: 1 UID: 0 PID: 5844 Comm: kworker/u9:2 Not tainted\n 6.14.0-syzkaller-10892-g4e82c87058f4 #0 PREEMPT(full)\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS\n Google 02/12/2025\n Workqueue: hci0 hci_devcd_timeout\n Call Trace:\n \n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:408 [inline]\n print_report+0xc3/0x670 mm/kasan/report.c:521\n kasan_report+0xe0/0x110 mm/kasan/report.c:634\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189\n __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105\n skb_put_data include/linux/skbuff.h:2752 [inline]\n hci_devcd_dump+0x142/0x240 net/bluetooth/coredump.c:258\n hci_devcd_timeout+0xb5/0x2e0 net/bluetooth/coredump.c:413\n process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238\n process_scheduled_works kernel/workqueue.c:3319 [inline]\n worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400\n kthread+0x3c2/0x780 kernel/kthread.c:464\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \n\n The buggy address ffffc90004ed5000 belongs to a vmalloc virtual mapping\n Memory state around the buggy address:\n ffffc90004ed4f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc90004ed4f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n >ffffc90004ed5000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffffc90004ed5080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc90004ed5100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ==================================================================\n\nTo avoid this issue, reorder dev_coredumpv to be called after\nskb_put_data that does not free the data.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "b257e02ecc46f8561d8bd88943164a10c9e90a80", "status": "affected", "versionType": "git", "lessThan": "efd55f6a59449f8d4e4953f12c177aa902b7451f" }, { "version": "b257e02ecc46f8561d8bd88943164a10c9e90a80", "status": "affected", "versionType": "git", "lessThan": "8c021ad797f9171d015cf0a932a3fbe5232190f5" }, { "version": "b257e02ecc46f8561d8bd88943164a10c9e90a80", "status": "affected", "versionType": "git", "lessThan": "7af4d7b53502286c6cf946d397ab183e76d14820" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "6.15", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "6.15" }, { "version": "6.15.10", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.15.*" }, { "version": "6.16.1", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.16.*" }, { "version": "6.17", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }