CVE-2025-68305: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68305 is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth HCI socket subsystem, specifically in the hci_sock component. It arises from a race condition between the socket bind operation and the socket write_iter operation, where bind may free a management command (cmd) via mgmt_pending_before while write_iter is still referencing it. The vulnerability was disclosed on December 16, 2025, and affects the Linux kernel across multiple stable branches. It carries a CVSS v3.1 base score of 7.0 (High), requiring low-privilege local access with high attack complexity (Red Hat Bugzilla, Red Hat CVE).

The root cause is a race condition (CWE-362) combined with a use-after-free memory error (CWE-416) in net/bluetooth/hci_sock.c. When two concurrent tasks operate on the same Bluetooth HCI socket — one performing a bind (which calls mgmt_pending_foreach → mgmt_pending_free to release a pending management command) and another performing a write_iter (which calls hci_sock_sendmsg → hci_mgmt_cmd → set_link_security → mgmt_pending_remove) — the freed memory can be accessed by the write path, triggering a KASAN-detected slab-use-after-free at mgmt_pending_remove+0x3b/0x210 in net/bluetooth/mgmt_util.c:316. The fix synchronizes both code paths using hci_dev_lock to prevent concurrent access to the shared management command structure. Exploitation requires a local attacker with the ability to open and manipulate Bluetooth HCI sockets, which typically requires CAP_NET_ADMIN or equivalent privileges (Red Hat Bugzilla).

Successful exploitation of this vulnerability can result in high confidentiality, integrity, and availability impact on the affected system. An attacker who triggers the UAF condition could potentially read sensitive kernel memory, corrupt kernel data structures, or cause a kernel panic (system crash). In a worst-case scenario, the memory corruption could be leveraged for local privilege escalation, enabling an attacker to gain elevated kernel-level access from a low-privileged user account (Red Hat CVE, Red Hat Bugzilla).

The Linux kernel upstream has addressed this vulnerability by introducing hci_dev_lock synchronization between the hci_sock_bind and hci_sock_sendmsg code paths. Red Hat has issued patches for affected products: RHSA-2026:1143 addresses Red Hat Enterprise Linux 9 (released January 26, 2026), and RHSA-2026:1690 addresses Red Hat Enterprise Linux 10 (released February 2, 2026). Ubuntu has released fixes via USN-8094-1 through USN-8094-5 and USN-8152-1. Oracle Linux and Rocky Linux have also issued corresponding advisories. Users should update to the latest patched kernel version provided by their distribution. As a short-term mitigation, restricting local user access to Bluetooth HCI sockets and applying least-privilege principles can reduce the attack surface (Red Hat Bugzilla, Red Hat RHSA-2026:1143, Red Hat RHSA-2026:1690).