Security readout for executives and security teams
Plain-English summary
A Linux Bluetooth ISO connection cleanup flaw can leave a stale kernel pointer and potentially reuse freed memory. A nearby, low-privileged attacker may be able to trigger memory corruption without user interaction, creating possible confidentiality, integrity, or availability impacts. The supplied evidence does not confirm real-world exploitation.
Executive priority
Treat this as a high-priority kernel update for Bluetooth-enabled endpoints, embedded devices, and exposed operational systems. Prioritize assets used near untrusted people or devices. Immediate emergency action is not supported by the supplied exploitation evidence, but patching should not wait for proof of attacks.
Technical view
The ISO Bluetooth cleanup path may fail to set conn->sk to NULL before iso_conn_free completes, creating a possible use-after-free condition similar to a previously addressed SCO issue. The CVSS 3.1 score is 8.0, with adjacent access, low privileges, low complexity, and no user interaction specified.
Likely exposure
Exposure is limited to systems running affected Linux kernels with the relevant Bluetooth ISO functionality reachable. The record lists 6.0, 6.1.156, 6.6.112, 6.12.53, 6.17.3, and 6.18, but its version presentation is ambiguous. Distribution backports may change actual status.
Exploitation context
The CVSS vector indicates an adjacent attacker with low privileges could attempt exploitation without user interaction. Because the issue affects kernel memory lifecycle, successful exploitation could be serious. However, CVE-2025-40141 is not identified as KEV, and the supplied sources provide no evidence of active exploitation or a public exploit.
Researcher notes
The record describes a possible use-after-free in iso_conn_free caused by retaining conn->sk. No CWE is assigned. Five Linux stable commits are referenced, likely reflecting fixes across maintained branches. Exact vulnerable ranges and distribution backport status require vendor verification; the supplied version data should not be interpreted as complete range boundaries.
Mitigation direction
- Install a vendor-supported kernel incorporating the applicable Linux stable fix.
- Check distribution advisories for backported fixes and corrected package versions.
- Prioritize Bluetooth-enabled systems accessible to untrusted nearby devices.
- Disable unnecessary Bluetooth functionality where operationally acceptable until patched.
Validation and detection
- Record each system's running kernel version and distribution package release.
- Verify whether the vendor kernel contains the applicable referenced stable commit.
- Confirm whether Bluetooth ISO functionality is enabled or operationally required.
- Reboot after updating, then verify the patched kernel is running.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40141 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.15.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8HighVector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/eba6d787ec117a5d2c60f9644e0a39c18542b6beCVE reference, Linux
- https://git.kernel.org/stable/c/5319145a07d8bf5b0782b25cb3115825689d42bbCVE reference, Linux
- https://git.kernel.org/stable/c/80689777919f02328eb873769de4647c9dd3e371CVE reference, Linux
- https://git.kernel.org/stable/c/c92ad1a155ccfa38b87bd1d998287e1c0a24248dCVE reference, Linux
- https://git.kernel.org/stable/c/9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.