CVE-2025-71082: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71082 is a use-after-free vulnerability in the Linux kernel's Bluetooth btusb driver, introduced by commit 98921dbd00c4e which switched memory allocation to devm_kzalloc(). The flaw ties the lifetime of all btusb data to a single USB interface (INTF), but the driver also binds to ISOC and DIAG interfaces; when btusb_disconnect() releases the primary interface, the devm framework prematurely frees memory still in use by the other interfaces. Affected kernel versions span from 3.7 through 5.15.197, 5.16 through 6.1.159, 6.2 through 6.6.119, 6.7 through 6.12.63, and 6.13 through 6.18.3. The vulnerability was published on January 13, 2026, with NVD initial analysis completed March 25, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly, NVD).

The root cause is improper memory lifetime management (CWE classified as insufficient information by NVD, but functionally a use-after-free / CWE-416) in btusb.c. When devm_kzalloc() is used in btusb_probe(), the allocated btusb data structure's lifetime is bound to the primary USB interface (INTF). However, because the btusb driver also binds to secondary interfaces (ISOC and DIAG), calling usb_driver_release_interface(&btusb_driver, data->intf) inside btusb_disconnect() triggers the devm framework to free the shared data structure while those secondary interfaces may still hold live references to it. The fix reverts to explicit kzalloc/kfree memory management, ensuring the data is only freed after all interfaces have been released (Feedly, kernel.org patch).

Successful exploitation can result in kernel crashes (denial of service), memory corruption, or disclosure of sensitive kernel memory contents, depending on how the freed memory region is subsequently reused. The vulnerability requires local access with low privileges and can be triggered by physically disconnecting a Bluetooth USB device while multiple driver interfaces remain active. Confidentiality, integrity, and availability are all rated High, reflecting the potential for kernel-level memory disclosure, data corruption, and system instability (Feedly, NVD).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access and physical interaction with a Bluetooth USB device, significantly limiting the attack surface.

Update the Linux kernel to a patched stable release: 5.15.198 or later (5.15.x branch), 6.1.160 or later (6.1.x branch), 6.6.120 or later (6.6.x branch), 6.12.64 or later (6.12.x branch), 6.18.4 or later (6.18.x branch), or 6.19-rc4 or later for development builds. Upstream patch commits include 1e54c19eaf84, 252714f1e8bd, c0ecb3e4451f, cca0e9206e3b, fdf7c640fb8a, and fff9206b0907. As a temporary workaround where patching is not immediately possible, physically disconnecting or disabling Bluetooth USB devices reduces exposure. Systems running Debian, Ubuntu, Oracle Linux, and other distributions should apply vendor-issued kernel security updates as they become available (Feedly, Ubuntu USN-8177-1, kernel.org patch).