ghsa-j8gp-j2vw-f2f6
Vulnerability from github
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_uart: Fix another race during initialization
Do not set 'HCI_UART_PROTO_READY' before call 'hci_uart_register_dev()'. Possible race is when someone calls 'hci_tty_uart_close()' after this bit is set, but 'hci_uart_register_dev()' wasn't done. This leads to access to uninitialized fields. To fix it let's set this bit after device was registered (as before patch c411c62cc133) and to fix previous problem let's add one more bit in addition to 'HCI_UART_PROTO_READY' which allows to perform power up without original bit set (pls see commit c411c62cc133).
Crash backtrace from syzbot report:
RIP: 0010:skb_queue_empty_lockless include/linux/skbuff.h:1887 [inline] RIP: 0010:skb_queue_purge_reason+0x6d/0x140 net/core/skbuff.c:3936
Call Trace: skb_queue_purge include/linux/skbuff.h:3364 [inline] mrvl_close+0x2f/0x90 drivers/bluetooth/hci_mrvl.c:100 hci_uart_tty_close+0xb6/0x120 drivers/bluetooth/hci_ldisc.c:557 tty_ldisc_close drivers/tty/tty_ldisc.c:455 [inline] tty_ldisc_kill+0x66/0xc0 drivers/tty/tty_ldisc.c:613 tty_ldisc_release+0xc9/0x120 drivers/tty/tty_ldisc.c:781 tty_release_struct+0x10/0x80 drivers/tty/tty_io.c:1690 tty_release+0x4ef/0x640 drivers/tty/tty_io.c:1861 __fput+0x86/0x2a0 fs/file_table.c:450 task_work_run+0x82/0xb0 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xa3/0x1b0 kernel/entry/common.c:218 do_syscall_64+0x9a/0x190 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f
{
"affected": [],
"aliases": [
"CVE-2025-23139"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T13:15:49Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_uart: Fix another race during initialization\n\nDo not set \u0027HCI_UART_PROTO_READY\u0027 before call \u0027hci_uart_register_dev()\u0027.\nPossible race is when someone calls \u0027hci_tty_uart_close()\u0027 after this bit\nis set, but \u0027hci_uart_register_dev()\u0027 wasn\u0027t done. This leads to access\nto uninitialized fields. To fix it let\u0027s set this bit after device was\nregistered (as before patch c411c62cc133) and to fix previous problem let\u0027s\nadd one more bit in addition to \u0027HCI_UART_PROTO_READY\u0027 which allows to\nperform power up without original bit set (pls see commit c411c62cc133).\n\nCrash backtrace from syzbot report:\n\nRIP: 0010:skb_queue_empty_lockless include/linux/skbuff.h:1887 [inline]\nRIP: 0010:skb_queue_purge_reason+0x6d/0x140 net/core/skbuff.c:3936\n\nCall Trace:\n \u003cTASK\u003e\n skb_queue_purge include/linux/skbuff.h:3364 [inline]\n mrvl_close+0x2f/0x90 drivers/bluetooth/hci_mrvl.c:100\n hci_uart_tty_close+0xb6/0x120 drivers/bluetooth/hci_ldisc.c:557\n tty_ldisc_close drivers/tty/tty_ldisc.c:455 [inline]\n tty_ldisc_kill+0x66/0xc0 drivers/tty/tty_ldisc.c:613\n tty_ldisc_release+0xc9/0x120 drivers/tty/tty_ldisc.c:781\n tty_release_struct+0x10/0x80 drivers/tty/tty_io.c:1690\n tty_release+0x4ef/0x640 drivers/tty/tty_io.c:1861\n __fput+0x86/0x2a0 fs/file_table.c:450\n task_work_run+0x82/0xb0 kernel/task_work.c:239\n resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]\n exit_to_user_mode_loop kernel/entry/common.c:114 [inline]\n exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]\n __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]\n syscall_exit_to_user_mode+0xa3/0x1b0 kernel/entry/common.c:218\n do_syscall_64+0x9a/0x190 arch/x86/entry/common.c:89\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
"id": "GHSA-j8gp-j2vw-f2f6",
"modified": "2025-05-02T09:30:31Z",
"published": "2025-05-01T15:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23139"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/02e1bcdfdf769974e7e9fa285e295cd9852e2a38"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1dcf08fcff5ca529de6dc0395091f28854f4e54a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/281782d2c6730241e300d630bb9f200d831ede71"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5df5dafc171b90d0b8d51547a82657cd5a1986c7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/80f14e9de6a43a0bd8194cad1003a3e6dcbc3984"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8e5aff600539e5faea294d9612cca50220e602b8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9e5a0f5777162e503400c70c6ed25fbbe2d38799"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a40f94f7caa8d3421b64f63ac31bc0f24c890f39"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/db7509fa110dd9b11134b75894677f30353b2c51"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.