CVE-2025-38118: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38118 is a use-after-free (UAF) vulnerability discovered in the Linux kernel's Bluetooth Management (MGMT) subsystem, specifically in the mgmtremoveadvmonitorcomplete function. The vulnerability was disclosed on July 3, 2025, affecting the Linux kernel's Bluetooth functionality (NVD, Debian).

The vulnerability occurs in the MGMTOPREMOVEADVMONITOR operation where mgmtpendingadd is used incorrectly, leading to a use-after-free condition. The issue manifests when reading 8 bytes at a specific memory address, triggered during the execution of the mgmtremoveadvmonitorcomplete function in net/bluetooth/mgmt.c at line 5406. The bug was detected using the Kernel Address Sanitizer (KASAN) tool, which identified the UAF condition during memory access operations (CVE).

The vulnerability could lead to memory corruption and potential system crashes due to accessing freed memory regions. This affects the Bluetooth management functionality in the Linux kernel, potentially impacting system stability and security (Debian).

The vulnerability has been fixed by reworking the MGMTOPREMOVEADVMONITOR operation to avoid using mgmtpendingadd. Various Linux distributions have released patches, with Debian marking it as fixed in versions 5.10.223-1 for bullseye and 6.12.35-1 for trixie (Debian).