Security readout for executives and security teams
Plain-English summary
A Linux kernel Bluetooth management flaw can access memory after it has been freed. The supplied CVSS assessment indicates a local, low-privileged attacker could potentially compromise confidentiality, integrity, or availability. The evidence does not establish a remote attack path or active exploitation.
Executive priority
Prioritize patching multi-user, developer, kiosk, and other Linux systems where untrusted users can obtain local access. Treat internet exposure alone as insufficient evidence of exploitability. Use normal high-severity remediation timelines, accelerating for Bluetooth-enabled systems with weak local access controls.
Technical view
A race in Bluetooth MGMT pending-command processing can free struct mgmt_pending while a completion callback still uses it, producing a use-after-free. The cited kernel fixes validate that the command remains pending and coordinate removal under mgmt_pending_lock to prevent time-of-check/time-of-use races.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions with the Bluetooth MGMT subsystem reachable by a local low-privileged user. The supplied record lists versions including 5.17, 6.6.140, 6.12.59, 6.16.10, and 6.17, but does not clearly express every affected range or distribution backport.
Exploitation context
The CVSS 3.1 vector is local, low-complexity, low-privilege, and requires no user interaction, with potentially high impact. The supplied record is not in CISA KEV and provides no evidence of public or active exploitation. A KASAN trace demonstrates the memory-safety failure in a test environment.
Researcher notes
The supplied trace shows an eight-byte read in mgmt_add_adv_patterns_monitor_sync after mgmt_pending_foreach freed the object during device power-off. The affected-version data is ambiguous and should be reconciled with stable-tree commits and distribution backports. No exploitability proof beyond the KASAN-detected use-after-free is supplied.
Mitigation direction
- Apply a vendor-supported kernel update containing the applicable cited stable fix.
- Check Linux distribution advisories for backported fixes and exact affected package versions.
- Restrict untrusted local access while patching is pending.
- Disable Bluetooth where operationally acceptable and unnecessary, following vendor guidance.
Validation and detection
- Record running kernel and distribution package versions across Linux assets.
- Compare each kernel package against distribution advisories and cited stable commits.
- Confirm the updated kernel is active after reboot, not merely installed.
- Review kernel logs for KASAN, Bluetooth MGMT, or unexpected crash indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39981 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0b60eb04b8524e1b4b3f07fea0d16fda9a677d9aCVE reference, Linux
- https://git.kernel.org/stable/c/d71b98f253b079cbadc83266383f26fe7e9e103bCVE reference, Linux
- https://git.kernel.org/stable/c/87a1f16f07c6c43771754075e08f45b41d237421CVE reference, Linux
- https://git.kernel.org/stable/c/302a1f674c00dd5581ab8e493ef44767c5101aabCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.