Loading story…
Red Hat disclosed CVE-2025-39981, a Linux kernel flaw in the Bluetooth management subsystem that can trigger a use-after-free or double-free condition in mgmt_pending handling. The bug was traced to struct mgmt_pending objects being freed while still in use, with a KASAN report identifying a slab use-after-free in mgmt_add_adv_patterns_monitor_sync. Red Hat rated the issue Moderate with a CVSS v3 score of 7.3, warning that a local attacker able to interact with the Bluetooth subsystem could cause memory corruption leading to denial of service or possible privilege escalation.
The weakness maps to CWE-416 (Use After Free), a class of memory-safety bugs that can enable crashes, information disclosure, or arbitrary code execution when freed memory is later referenced. The kernel fix adds mgmt_pending_valid checks and removes commands from the pending list while holding mgmt_pending_lock to prevent TOCTOU-related misuse. Red Hat said fixes were shipped for multiple RHEL 8, 9, and 10 kernel packages, while RHEL 6 was not affected because the vulnerable code is absent; the company also recommended hardening or disabling Bluetooth management interfaces where they are not needed.
Get the actors, campaigns, and ATT&CK mapping behind it.
11 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2025:22854 to address CVE-2025-39981 in the Red Hat Enterprise Linux 10 kernel.
Red Hat released RHSA-2025:22405 to fix CVE-2025-39981 in the Red Hat Enterprise Linux 9 kernel.
Red Hat made its entry for CVE-2025-39981 public, describing a Linux kernel Bluetooth management flaw that can cause use-after-free or double-free conditions in mgmt_pending handling.
The Linux kernel CVE team announced CVE-2025-39981 as a Bluetooth MGMT use-after-free flaw caused by struct mgmt_pending being freed while still processed. The announcement said the issue was introduced in kernel 5.17 and fixed upstream in Linux 6.16.10 and 6.17.
MITRE recorded updates to the CWE-416 Use After Free entry through CWE version 4.20.
Red Hat released RHSA-2026:21706 for the Red Hat Enterprise Linux 8 kernel and RHSA-2026:21745 for the RHEL 8 kernel-rt, both addressing CVE-2025-39981.
Red Hat released RHSA-2026:10108 to fix CVE-2025-39981 in the Red Hat Enterprise Linux 9.4 Extended Update Support kernel.
Red Hat released RHSA-2026:9644 to address CVE-2025-39981 for the Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions kernel.
Red Hat released RHSA-2026:9512 to fix CVE-2025-39981 for the Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions kernel-rt.
Red Hat released RHSA-2026:0457 to address CVE-2025-39981 in the Red Hat Enterprise Linux 9.6 Extended Update Support kernel.
Red Hat released RHSA-2026:0271 to fix CVE-2025-39981 for the Red Hat Enterprise Linux 10.0 Extended Update Support kernel.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw in the Linux kernel's Bluetooth management (`MGMT`) component, tracked as **CVE-2026-43020**, was fixed after maintainers found that Long Term Key (`LTK`) `enc_size` values were not properly validated during load operations. An attacker with local low-privilege access could supply an `enc_size` larger than the 16-byte key buffer, allowing invalid data to be stored and later used in fixed-size stack operations when the kernel replied to LE LTK requests, creating a stack buffer overflow condition with denial-of-service and possible broader memory-corruption impact. The vulnerable code is in `net/bluetooth/mgmt.c` and has reportedly been present since Linux kernel 3.4. Upstream fixes were released across multiple stable branches, including 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0, by rejecting oversized `enc_size` values during management LTK record validation. Red Hat said fixes were issued for Red Hat Enterprise Linux 8, 9, and 10 through RHSA advisories, while RHEL 7, RHEL 7 `kernel-rt`, and RHEL 9 `kernel-rt` remained listed as affected at publication; RHEL 6 was listed as not affected because the vulnerable code is absent.
Aug 25, 2026
Red Hat released **RHSA-2024:4098** to remediate `CVE-2023-2002`, a moderate-severity Linux kernel flaw in the Bluetooth HCI socket implementation. The missing capability check in `net/bluetooth/hci_sock.c` can allow a low-privileged attacker with adjacent Bluetooth-network access to issue unauthorized Bluetooth management commands, potentially affecting the confidentiality, integrity, and availability of Bluetooth communications. The advisory provides kernel version `3.10.0-957.114.1.el7` for Red Hat Enterprise Linux Server AUS 7.6 on x86_64. Red Hat rates the issue CVSS 3.1 **6.8** and classifies it as CWE-250, Execution with Unnecessary Privileges; fixes are also available for affected RHEL 7 and 8 kernel and kernel-rt packages. Administrators should apply applicable prior errata and reboot systems after installing the update, as no generally suitable mitigation is available.
Aug 26, 2026
A use-after-free flaw in the Linux kernel's Bluetooth SCO implementation, tracked as **CVE-2026-31408**, was fixed after maintainers found that `sco_recv_frame()` could access a socket after it had been freed during a concurrent `close()`. The bug stems from reading `conn->sk` while holding `sco_conn_lock()` and then releasing the lock before safely retaining a socket reference, creating a race that can lead to memory corruption or a denial of service. Upstream records say the vulnerable code path existed since Linux `2.6.12`, and the fix adds `sco_sock_hold()` before unlocking along with `sock_put()` on all exit paths. The Linux kernel CVE team published fixes across multiple stable branches, including `6.6.131`, `6.12.80`, `6.18.21`, `6.19.11`, and `7.0-rc6`, and advised users to move to the latest stable kernel rather than cherry-picking patches. Red Hat rated the issue **Moderate** for its products, assigned a CVSS v3 score of `7.0`, and said updated kernel packages were released for multiple Red Hat Enterprise Linux lines, including **RHEL 8, 9, and 10** and related support variants; upstream CVE scoring lists the flaw at `8.8` under adjacent-network Bluetooth attack conditions.
Aug 25, 2026