{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-40294",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-40294",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-12-08T00:46:17.899Z",
    "updatedAt": "2026-06-16T19:53:41.561Z",
    "importedAt": "2026-10-24T01:57:34.152Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()\n\nIn the parse_adv_monitor_pattern() function, the value of\nthe 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251).\nThe size of the 'value' array in the mgmt_adv_pattern structure is 31.\nIf the value of 'pattern[i].length' is set in the user space\nand exceeds 31, the 'patterns[i].value' array can be accessed\nout of bound when copied.\n\nIncreasing the size of the 'value' array in\nthe 'mgmt_adv_pattern' structure will break the userspace.\nConsidering this, and to avoid OOB access revert the limits for 'offset'\nand 'length' back to the value of HCI_MAX_AD_LENGTH.\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with SVACE.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "99f30e12e588f9982a6eb1916e53510bff25b3b8",
              "status": "affected",
              "versionType": "git",
              "lessThan": "96616530f524a0a76248cd44201de0a9e8526190"
            },
            {
              "version": "db08722fc7d46168fe31d9b8a7b29229dd959f9f",
              "status": "affected",
              "versionType": "git",
              "lessThan": "5f7350ff2b179764a4f40ba4161b60b8aaef857b"
            },
            {
              "version": "db08722fc7d46168fe31d9b8a7b29229dd959f9f",
              "status": "affected",
              "versionType": "git",
              "lessThan": "4b7d4aa5399b5a64caee639275615c63c008540d"
            },
            {
              "version": "db08722fc7d46168fe31d9b8a7b29229dd959f9f",
              "status": "affected",
              "versionType": "git",
              "lessThan": "3a50d59b3781bc3a4e96533612509546a4c309a7"
            },
            {
              "version": "db08722fc7d46168fe31d9b8a7b29229dd959f9f",
              "status": "affected",
              "versionType": "git",
              "lessThan": "8d59fba49362c65332395789fd82771f1028d87e"
            },
            {
              "version": "6.1.83",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.1.159"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.6",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.6"
            },
            {
              "version": "6.1.159",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.117",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.58",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.17.8",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.17.*"
            },
            {
              "version": "6.18",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}