GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38303 (GCVE-0-2025-38303)

Vulnerability from cvelistv5 – Published: 2025-07-10 07:42 – Updated: 2026-08-05 12:01
VLAI
Title
Bluetooth: eir: Fix possible crashes on eir_create_adv_data
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix possible crashes on eir_create_adv_data eir_create_adv_data may attempt to add EIR_FLAGS and EIR_TX_POWER without checking if that would fit.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 01ce70b0a274bd76a5a311fb90d4d446d9bdfea1 , < 2d4588f55cc10fc228f3b46469dbfb3f0a8b13c8 (git)
Affected: 01ce70b0a274bd76a5a311fb90d4d446d9bdfea1 , < 2af40d795d3fb0ee5c074b7ac56ab22402aa6e4f (git)
Affected: 01ce70b0a274bd76a5a311fb90d4d446d9bdfea1 , < b9db0c27e73b7c8a19384a44af527edfda74ff3d (git)
Affected: 01ce70b0a274bd76a5a311fb90d4d446d9bdfea1 , < 47c03902269aff377f959dc3fd94a9733aa31d6e (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.1.168 , ≤ 6.1.* (semver)
Unaffected: 6.12.34 , ≤ 6.12.* (semver)
Unaffected: 6.15.3 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/eir.c",
            "net/bluetooth/eir.h",
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2d4588f55cc10fc228f3b46469dbfb3f0a8b13c8",
              "status": "affected",
              "version": "01ce70b0a274bd76a5a311fb90d4d446d9bdfea1",
              "versionType": "git"
            },
            {
              "lessThan": "2af40d795d3fb0ee5c074b7ac56ab22402aa6e4f",
              "status": "affected",
              "version": "01ce70b0a274bd76a5a311fb90d4d446d9bdfea1",
              "versionType": "git"
            },
            {
              "lessThan": "b9db0c27e73b7c8a19384a44af527edfda74ff3d",
              "status": "affected",
              "version": "01ce70b0a274bd76a5a311fb90d4d446d9bdfea1",
              "versionType": "git"
            },
            {
              "lessThan": "47c03902269aff377f959dc3fd94a9733aa31d6e",
              "status": "affected",
              "version": "01ce70b0a274bd76a5a311fb90d4d446d9bdfea1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/eir.c",
            "net/bluetooth/eir.h",
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: eir: Fix possible crashes on eir_create_adv_data\n\neir_create_adv_data may attempt to add EIR_FLAGS and EIR_TX_POWER\nwithout checking if that would fit."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is driven entirely by locally-configured advertising data submitted over an AF_BLUETOOTH HCI control socket (MGMT_OP_ADD_ADVERTISING / MGMT_OP_ADD_EXT_ADV_DATA), so local system access is mandatory. No adjacent or remote Bluetooth peer supplies any of the data consumed by eir_create_adv_data(), since advertising payloads are outbound and locally authored.\nAC:L - The attacker deterministically controls every input to the overflow \u2014 the adv instance flags (MGMT_ADV_FLAG_TX_POWER without a managed-flags bit), the exact adv_data_len at the tlv_data_max_len ceiling, and the BR/EDR-disabled state (MGMT_OP_SET_BREDR) that makes the kernel prepend the unbudgeted LE_AD_NO_BREDR Flags AD. There is no race, no timing window, and no memory-layout precondition outside the attacker\u0027s influence.\nPR:L - The handlers lack HCI_MGMT_UNTRUSTED so the socket must be CAP_NET_ADMIN-trusted, but in the realistic Bluetooth deployments for this code (Android\u0027s non-root AID_BLUETOOTH service, ChromeOS/embedded/automotive BT daemons) that capability is held by an unprivileged, remotely-exposed, SELinux-confined daemon rather than by root. A compromised Bluetooth daemon \u2014 far short of full admin \u2014 is sufficient to reach the bug.\nUI:N - The attacker issues every mgmt command needed (set bredr off, add advertising with a max-length payload) from its own socket, and the overflow fires from the hci_cmd_sync_work kthread without any victim action. No pairing, connection, or user-initiated operation by another party is involved.\nS:U - The corruption occurs on the kernel stack of the Bluetooth command-sync worker, within the same kernel security authority as the vulnerable code. No VM, IOMMU, container, or sandbox boundary is crossed.\nC:H - In the extended-advertising path the inflated return value propagates into struct_size(pdu, data, len), so the HCI command skb is assembled from bytes beyond the 255-byte stack object, leaking adjacent kernel stack contents into the HCI command stream and to HCI monitor consumers; the legacy path similarly publishes hdev-\u003eadv_data_len = 34 with only 31 valid bytes. Combined with the stack-corruption primitive, this is leverageable for kernel memory disclosure.\nI:H - This is an out-of-bounds write past a fixed-size stack buffer, placing attacker-influenced bytes (0x02, EIR_TX_POWER, and a tx_power value the attacker can steer via the advertising parameters) into adjacent stack storage of the hci_cmd_sync_work frame. Per the OOB-write classification this is a control-flow-relevant corruption primitive, not a mere bad read.\nA:H - The commit is titled \"Fix possible crashes\" and the confirmed KASAN report on this code shows stack-out-of-bounds writes in eir_create_adv_data() from hci_cmd_sync_work. On stack-protector kernels overwriting past the buffer trips __stack_chk_fail and panics the machine; otherwise it oopses or corrupts the worker\u0027s frame, taking down the Bluetooth subsystem or the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:04.412Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2d4588f55cc10fc228f3b46469dbfb3f0a8b13c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2af40d795d3fb0ee5c074b7ac56ab22402aa6e4f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9db0c27e73b7c8a19384a44af527edfda74ff3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/47c03902269aff377f959dc3fd94a9733aa31d6e"
        }
      ],
      "title": "Bluetooth: eir: Fix possible crashes on eir_create_adv_data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38303",
    "datePublished": "2025-07-10T07:42:14.728Z",
    "dateReserved": "2025-04-16T04:51:24.002Z",
    "dateUpdated": "2026-08-05T12:01:04.412Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38303",
      "date": "2026-09-16",
      "epss": "0.00164",
      "percentile": "0.05981"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T02:01:45.000Z",
      "cve": "CVE-2025-38303",
      "id": "msrc_CVE-2025-38303",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:known_affected": "16",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: eir: Fix possible crashes on eir_create_adv_data",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38303.json",
      "version": "13"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38303\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-10T08:15:29.090\",\"lastModified\":\"2026-07-30T06:23:06.767\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: eir: Fix possible crashes on eir_create_adv_data\\n\\neir_create_adv_data may attempt to add EIR_FLAGS and EIR_TX_POWER\\nwithout checking if that would fit.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: eir: Se solucionan posibles fallos en eir_create_adv_data eir_create_adv_data puede intentar agregar EIR_FLAGS y EIR_TX_POWER sin verificar si encajan.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/eir.c\",\"net/bluetooth/eir.h\",\"net/bluetooth/hci_sync.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"01ce70b0a274bd76a5a311fb90d4d446d9bdfea1\",\"lessThan\":\"2d4588f55cc10fc228f3b46469dbfb3f0a8b13c8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01ce70b0a274bd76a5a311fb90d4d446d9bdfea1\",\"lessThan\":\"2af40d795d3fb0ee5c074b7ac56ab22402aa6e4f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01ce70b0a274bd76a5a311fb90d4d446d9bdfea1\",\"lessThan\":\"b9db0c27e73b7c8a19384a44af527edfda74ff3d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01ce70b0a274bd76a5a311fb90d4d446d9bdfea1\",\"lessThan\":\"47c03902269aff377f959dc3fd94a9733aa31d6e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/eir.c\",\"net/bluetooth/eir.h\",\"net/bluetooth/hci_sync.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.168\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.34\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.3\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.12.34\",\"matchCriteriaId\":\"EE65E176-D370-4F66-971E-A0E3513C9C2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.3\",\"matchCriteriaId\":\"0541C761-BD5E-4C1A-8432-83B375D7EB92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2af40d795d3fb0ee5c074b7ac56ab22402aa6e4f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2d4588f55cc10fc228f3b46469dbfb3f0a8b13c8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/47c03902269aff377f959dc3fd94a9733aa31d6e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b9db0c27e73b7c8a19384a44af527edfda74ff3d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:12:49+00:00",
      "cve": "CVE-2025-38303",
      "id": "CVE-2025-38303",
      "initial_release_date": "2025-07-10T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: eir: Fix possible crashes on eir_create_adv_data",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38303.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:19:20Z",
      "cve": "CVE-2025-38303",
      "id": "CVE-2025-38303",
      "initial_release_date": "2025-07-10T23:22:58Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "477",
      "product_status:known_not_affected": "359",
      "product_status:recommended": "472",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38303",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38303.json",
      "version": "45"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.