CVE-2025-40283: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40283 is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth USB driver (btusb) that occurs during device disconnection. The flaw exists in the btusb_disconnect() function, where a call to usb_driver_release_interface() frees the btusb data structure, but subsequent code in the same function continues to access that already-freed memory. The vulnerability was published on December 6, 2025, and affects Linux kernel versions from 4.11 up to the patched releases across multiple stable branches. It carries a CVSS v3.1 base score of 7.1 (High), with local attack vector and low privileges required (Red Hat CVE, Microsoft MSRC).

The root cause is a use-after-free condition (CWE-416) in the btusb_disconnect() function of the Linux kernel's btusb Bluetooth USB driver. When a Bluetooth USB device is disconnected, the function calls usb_driver_release_interface(&btusb_driver, data->intf), which internally frees the btusb data structure associated with the interface. Code later in the same function then dereferences the now-freed data pointer, triggering a KASAN-detected slab-use-after-free read. The fix reorders the operations so that all accesses to btusb data occur before the interface is released and the data is freed (Red Hat CVE). Exploitation requires local access and low privileges, as an attacker would need to be able to trigger a Bluetooth USB device disconnection event on the target system.

Successful exploitation of this vulnerability could lead to kernel memory corruption, system instability, or kernel crashes (denial of service) due to the use-after-free condition in the Bluetooth USB driver. In more severe scenarios, an attacker with local access could potentially leverage the memory corruption to achieve privilege escalation or arbitrary code execution in kernel context, resulting in full system compromise. Confidentiality and availability are both rated as HIGH impact, while integrity impact is assessed as NONE based on the CVSS scoring (Red Hat CVE, Microsoft MSRC).

There is no public proof-of-concept exploit code available for CVE-2025-40283, and no evidence of active in-the-wild exploitation has been reported (Red Hat CVE). The vulnerability has an EPSS score of approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, limiting the attack surface primarily to scenarios involving physical or authenticated local access to systems with Bluetooth USB adapters.

Patches have been released for multiple Linux kernel stable branches: 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.59, 6.17.9, and 6.18 (Red Hat CVE). Users should update to the latest patched kernel version for their distribution. Ubuntu has issued security notices USN-8096-1, USN-8096-2, USN-8096-3, and USN-8096-5 addressing this vulnerability. As a temporary workaround where patching is not immediately possible, disabling Bluetooth USB functionality or restricting physical access to systems with Bluetooth USB adapters can reduce exposure. Debian LTS users should refer to DLA-4436-1 for applicable fixes.