High

Use-after-free in Linux kernel Bluetooth L2CAP l2cap_send_cmd

IdentifiersCVE-2025-21969CWE-416· Use After Free

CVE-2025-21969 is a slab use-after-free vulnerability in the Linux kernel Bluetooth L2CAP subsystem. The flaw occurs because an L2CAP connection object can be released by the HCI synchronous command path while the HCI receive-data workqueue still references that same object and later uses it when processing received data and sending a command to the upper layer. The reported crash occurs in l2cap_send_cmd, reached from L2CAP frame processing in the Bluetooth stack. The issue is a race condition between connection teardown and asynchronous receive processing, resulting in dereference of freed memory. The fix adds HCI device locking in the HCI receive-data workqueue to synchronize these paths and prevent stale l2cap_conn references from being used after free.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can cause kernel memory safety violations in the Bluetooth stack, primarily leading to denial of service through kernel crashes or instability. Because the flaw is a use-after-free in kernel context, memory corruption is possible and could potentially enable more serious impacts such as unintended kernel behavior or, depending on exploitability in a given environment, privilege escalation or code execution in kernel context. The available information specifically confirms a slab use-after-free read and does not establish reliable code execution.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure to the Bluetooth attack surface by disabling Bluetooth functionality on affected systems, unloading or blacklisting Bluetooth kernel modules where operationally feasible, and preventing untrusted or unnecessary Bluetooth connectivity. Limiting access to local or nearby attackers who can interact with the Bluetooth stack may reduce risk, but no complete workaround is available short of applying a fixed kernel.

Remediation

Patch, then assume compromise.

Apply a Linux kernel update that includes the fix for CVE-2025-21969. The upstream remediation synchronizes the HCI receive-data workqueue with connection teardown by adding HCI device locking so that l2cap_conn objects are not referenced after release. Vendor kernel updates incorporating this fix should be installed, and systems should be rebooted after updating where required for the new kernel to take effect.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

LinuxLinux Kerneloperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

redhat accessNews

Jan 1, 2026

RHSA-2025:9080 - Security Advisory - Red Hat Customer Portal

A Linux kernel Bluetooth L2CAP use-after-free vulnerability in l2cap_send_cmd.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity