linux-cve-announce - CVE-2025-37918: Bluetooth: btusb: avoid NULL pointer dereference in skb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025052001-CVE-2025-37918-db24@gregkh>
Date: Tue, 20 May 2025 17:22:15 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-37918: Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()

A NULL pointer dereference can occur in skb_dequeue() when processing a
QCA firmware crash dump on WCN7851 (0489:e0f3).

[ 93.672166] Bluetooth: hci0: ACL memdump size(589824)

[ 93.672475] BUG: kernel NULL pointer dereference, address: 0000000000000008
[ 93.672517] Workqueue: hci0 hci_devcd_rx [bluetooth]
[ 93.672598] RIP: 0010:skb_dequeue+0x50/0x80

The issue stems from handle_dump_pkt_qca() returning 0 even when a dump
packet is successfully processed. This is because it incorrectly
forwards the return value of hci_devcd_init() (which returns 0 on
success). As a result, the caller (btusb_recv_acl_qca() or
btusb_recv_evt_qca()) assumes the packet was not handled and passes it
to hci_recv_frame(), leading to premature kfree() of the skb.

Later, hci_devcd_rx() attempts to dequeue the same skb from the dump
queue, resulting in a NULL pointer dereference.

Fix this by:
1. Making handle_dump_pkt_qca() return 0 on success and negative errno
   on failure, consistent with kernel conventions.
2. Splitting dump packet detection into separate functions for ACL
   and event packets for better structure and readability.

This ensures dump packets are properly identified and consumed, avoiding
double handling and preventing NULL pointer access.

The Linux kernel CVE team has assigned CVE-2025-37918 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 6.4 with commit 20981ce2d5a5f79d17da1ace3a93df7b3c6ba3d6 and fixed in 6.6.90 with commit 2e8d44ebaa7babdd5c5ab50ca275826e241920d6
	Issue introduced in 6.4 with commit 20981ce2d5a5f79d17da1ace3a93df7b3c6ba3d6 and fixed in 6.12.28 with commit b70b41591ec48c78ec6a885e1f57bfc4029e5e13
	Issue introduced in 6.4 with commit 20981ce2d5a5f79d17da1ace3a93df7b3c6ba3d6 and fixed in 6.14.6 with commit 8563d9fabd8a4b726ba7acab4737c438bf11a059
	Issue introduced in 6.4 with commit 20981ce2d5a5f79d17da1ace3a93df7b3c6ba3d6 and fixed in 6.15-rc5 with commit 0317b033abcd1d8dd2798f0e2de5e84543d0bd22

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-37918
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/bluetooth/btusb.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/2e8d44ebaa7babdd5c5ab50ca275826e241920d6
	https://git.kernel.org/stable/c/b70b41591ec48c78ec6a885e1f57bfc4029e5e13
	https://git.kernel.org/stable/c/8563d9fabd8a4b726ba7acab4737c438bf11a059
	https://git.kernel.org/stable/c/0317b033abcd1d8dd2798f0e2de5e84543d0bd22