CVE-2025-40318: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40318 is a race condition vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the hci_cmd_sync_dequeue_once() function within hci_sync.c. The flaw allows a use-after-free (UAF) condition and double list_del() to occur when hci_cmd_sync_dequeue_once() performs a lookup and cancel of a command sync entry under two separate lock sections, while hci_cmd_sync_work() can concurrently delete the same entry. It was published on December 8, 2025, and affects multiple Linux kernel stable branches. The CVSS v3.1 base score is 7.0 (High), requiring local access with low privileges (Red Hat CVE, Feedly).

The root cause is a time-of-check to time-of-use (TOCTOU) race condition (CWE-362) in the Bluetooth HCI command synchronization subsystem. hci_cmd_sync_dequeue_once() performs a list lookup and then a cancel operation in two separate critical sections protected by cmd_sync_work_lock, creating a window during which hci_cmd_sync_work() can delete the same list entry concurrently. This leads to a double list_del() call and a use-after-free (UAF) memory corruption condition. The fix involves holding cmd_sync_work_lock across both the lookup and cancel operations atomically, eliminating the race window (Red Hat CVE, ENISA EUVD). Affected kernel commit ranges include versions introduced at 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 across multiple stable branches (ENISA EUVD).

Successful exploitation of this UAF vulnerability can result in high confidentiality, integrity, and availability impact on the affected system. A local attacker with low privileges could leverage the memory corruption to read sensitive kernel memory, corrupt kernel data structures, or crash the system (kernel panic). In more sophisticated scenarios, the UAF could be chained with other primitives to achieve local privilege escalation (Red Hat CVE, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-40318. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and high attack complexity due to the race condition nature of the flaw (Red Hat CVE, Feedly).

The Linux kernel project has released patches for multiple stable branches: kernel versions 6.1.159, 6.6.117, 6.12.58, 6.17.8, and 6.18 contain the fix (ENISA EUVD). Red Hat has issued errata RHSA-2026:1194, RHSA-2026:1690, RHSA-2026:1727, and RHSA-2026:2212 addressing this vulnerability (Red Hat RHSA-2026:2212). IBM has also released a patch for affected Netezza Appliance products (IBM Advisory). Debian LTS addressed this in advisory DLA-4436-1. Administrators should update to a patched kernel version as the primary remediation; as a temporary workaround, disabling Bluetooth on systems where it is not required reduces the attack surface.