CVE-2025-21937: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-21937 is a vulnerability discovered in the Linux kernel's Bluetooth subsystem, specifically in the mgmtremotename() function. The vulnerability was disclosed on April 1, 2025, and affects Linux kernel versions from 6.13 up to 6.13.7 and other versions. The issue stems from a missing check for the return value of mgmtallocskb() function (NVD).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) issue. It has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access requirements and potential high impact on availability (NVD).

The vulnerability can lead to a null pointer dereference in the Linux kernel's Bluetooth subsystem, potentially resulting in a system crash or denial of service condition (NVD).

The vulnerability has been fixed by adding a check for the return value of mgmtallocskb() in the mgmtremotename() function. Multiple Linux distributions have released patches to address this issue, including Ubuntu and Debian. For Debian's stable distribution (bookworm), the fix is included in version 6.1.133-1 (Debian Security).