CVE-2025-39860: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39860 is a use-after-free vulnerability discovered in the Linux kernel's Bluetooth subsystem, specifically in the l2capsockcleanup_listen() function. The vulnerability was disclosed on September 19, 2025, affecting the Linux kernel's Bluetooth implementation (NVD Database).

The vulnerability occurs when a single thread calling btacceptdequeue() frees a socket (sk) and subsequently accesses it. The root cause is identified as a race condition in the l2capsockcleanuplisten() function. The issue manifests during list iteration in btacceptdequeue() where two threads could simultaneously access the same socket, leading to a use-after-free condition. This occurs because btacceptdequeue() is called under locksock() except for l2capsockrelease() (NVD Database).

The vulnerability could potentially lead to privilege escalation, denial of service, or information leaks in affected Linux systems (Debian Security).

The vulnerability has been resolved in various Linux distributions. Debian has fixed the issue in version 6.12.48-1 for the stable distribution (trixie) and version 6.1.153-1 for the oldstable distribution (bookworm). Users are recommended to upgrade their Linux packages to the patched versions (Debian Security).