CVE-2025-40294
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251). The size of the 'value' array in the mgmt_adv_pattern structure is 31. If the value of 'pattern[i].length' is set in the user space and exceeds 31, the 'patterns[i].value' array can be accessed out of bound when copied. Increasing the size of the 'value' array in the 'mgmt_adv_pattern' structure will break the userspace. Considering this, and to avoid OOB access revert the limits for 'offset' and 'length' back to the value of HCI_MAX_AD_LENGTH. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: alma — https://errata.almalinux.org/9/ALSA-2026-1143.html
Vendor advisory: alma — https://bugzilla.redhat.com/2422840
Vendor advisory: alma — https://bugzilla.redhat.com/2422836
Vendor advisory: alma — https://bugzilla.redhat.com/2419891
Vendor advisory: alma — https://bugzilla.redhat.com/2418876
Vendor advisory: alma — https://bugzilla.redhat.com/2418872
Vendor advisory: alma — https://bugzilla.redhat.com/2393488
Vendor advisory: alma — https://bugzilla.redhat.com/2381870
Vendor advisory: alma — https://bugzilla.redhat.com/2376052
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2025-40294
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2026:1143
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2025-40294.html
Vendor advisory: redhat — https://access.redhat.com/errata/RHSA-2026:1143
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rhel | 9 | fixed | |
| sles | affected | | |
| rocky | 9 | fixed | |
| debian | bookworm | fixed | 6.1.159-1 |
| debian | bullseye | fixed | 0 |
| debian | forky | fixed | 6.17.8-1 |
| debian | sid | fixed | 6.17.8-1 |
| debian | trixie | fixed | 6.12.63-1 |
References
- https://access.redhat.com/errata/RHSA-2026:1143
- https://www.suse.com/security/cve/CVE-2025-40294.html
- https://errata.rockylinux.org/RLSA-2026:1143
- https://security-tracker.debian.org/tracker/CVE-2025-40294
- https://bugzilla.redhat.com/2376052
- https://bugzilla.redhat.com/2381870
- https://bugzilla.redhat.com/2393488
- https://bugzilla.redhat.com/2418872
- https://bugzilla.redhat.com/2418876
- https://bugzilla.redhat.com/2419891
- https://bugzilla.redhat.com/2422836
- https://bugzilla.redhat.com/2422840
- https://errata.almalinux.org/9/ALSA-2026-1143.html
Verify integrity in audit chain (admin only). AS-IS.