CVE-2025-38473

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()<br /> <br /> syzbot reported null-ptr-deref in l2cap_sock_resume_cb(). [0]<br /> <br /> l2cap_sock_resume_cb() has a similar problem that was fixed by commit<br /> 1bff51ea59a9 ("Bluetooth: fix use-after-free error in lock_sock_nested()").<br /> <br /> Since both l2cap_sock_kill() and l2cap_sock_resume_cb() are executed<br /> under l2cap_sock_resume_cb(), we can avoid the issue simply by checking<br /> if chan-&gt;data is NULL.<br /> <br /> Let&amp;#39;s not access to the killed socket in l2cap_sock_resume_cb().<br /> <br /> [0]:<br /> BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:82 [inline]<br /> BUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]<br /> BUG: KASAN: null-ptr-deref in l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711<br /> Write of size 8 at addr 0000000000000570 by task kworker/u9:0/52<br /> <br /> CPU: 1 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT<br /> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025<br /> Workqueue: hci0 hci_rx_work<br /> Call trace:<br /> show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:501 (C)<br /> __dump_stack+0x30/0x40 lib/dump_stack.c:94<br /> dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120<br /> print_report+0x58/0x84 mm/kasan/report.c:524<br /> kasan_report+0xb0/0x110 mm/kasan/report.c:634<br /> check_region_inline mm/kasan/generic.c:-1 [inline]<br /> kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189<br /> __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37<br /> instrument_atomic_write include/linux/instrumented.h:82 [inline]<br /> clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]<br /> l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711<br /> l2cap_security_cfm+0x524/0xea0 net/bluetooth/l2cap_core.c:7357<br /> hci_auth_cfm include/net/bluetooth/hci_core.h:2092 [inline]<br /> hci_auth_complete_evt+0x2e8/0xa4c net/bluetooth/hci_event.c:3514<br /> hci_event_func net/bluetooth/hci_event.c:7511 [inline]<br /> hci_event_packet+0x650/0xe9c net/bluetooth/hci_event.c:7565<br /> hci_rx_work+0x320/0xb18 net/bluetooth/hci_core.c:4070<br /> process_one_work+0x7e8/0x155c kernel/workqueue.c:3238<br /> process_scheduled_works kernel/workqueue.c:3321 [inline]<br /> worker_thread+0x958/0xed8 kernel/workqueue.c:3402<br /> kthread+0x5fc/0x75c kernel/kthread.c:464<br /> ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847