Security readout for executives and security teams
Plain-English summary
A Linux Bluetooth crash-dump handling flaw can access memory after the underlying buffer has been freed. The supplied report demonstrates an out-of-bounds read and kernel crash detection. The CVSS rating is 8.8, but the sources do not establish real-world exploitation or prove code execution.
Executive priority
Prioritize remediation as high where affected kernels and Bluetooth functionality are present. The 8.8 score warrants prompt action, while the absence of documented active exploitation supports risk-based scheduling rather than emergency incident response. Require teams to verify vendor backports because version data alone is inconclusive.
Technical view
In hci_devcd_dump, dev_coredumpv may discard and free hdev->dump.head when an earlier coredump remains unread. A subsequent skb_put_data then reads that freed buffer, producing a vmalloc out-of-bounds condition. The fix reorders operations so skb_put_data runs before dev_coredumpv can release the data.
Likely exposure
Exposure is limited to Linux kernels containing the vulnerable Bluetooth HCI device-coredump logic. The supplied affected data names 6.15, 6.15.10, 6.16.1, and 6.17, but includes ambiguous version data. Confirm exact distribution versions and backports with the kernel vendor.
Exploitation context
The supplied CVSS vector describes adjacent-network reachability without privileges or user interaction. However, the bundle provides only a syzbot-generated crash report, identifies no public exploitation, and states KEV is false. Preconditions and practical security impact beyond the demonstrated out-of-bounds access remain incomplete.
Researcher notes
The concrete failure is a buffer-lifetime ordering error in net/bluetooth/coredump.c. Evidence demonstrates an out-of-bounds read detected by KASAN during timeout work. Although the supplied CVSS assigns high confidentiality, integrity, and availability impact, these sources do not explain a reliable path from the observed crash to those outcomes.
Mitigation direction
- Apply a vendor-supported kernel update containing the referenced upstream fix or equivalent backport.
- Check distribution advisories to resolve the bundle's ambiguous affected-version data.
- Prioritize Bluetooth-capable systems running potentially affected kernels until their backport status is confirmed.
Validation and detection
- Inventory deployed kernel versions and identify systems using the Linux Bluetooth stack.
- Confirm the running kernel contains a referenced fix or documented vendor-equivalent backport.
- Review kernel logs for hci_devcd_dump, skb_put_data, KASAN, or vmalloc-out-of-bounds reports.
- After updating, verify normal Bluetooth operation and device-coredump handling in a controlled environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38592 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/efd55f6a59449f8d4e4953f12c177aa902b7451fCVE reference, Linux
- https://git.kernel.org/stable/c/8c021ad797f9171d015cf0a932a3fbe5232190f5CVE reference, Linux
- https://git.kernel.org/stable/c/7af4d7b53502286c6cf946d397ab183e76d14820CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.