CVE-2025-38592

CVE-2025-38592 is a Linux kernel vulnerability affecting the Bluetooth subsystem, specifically within the hci_devcd_dump function. It arises from a timing issue where dev_coredumpv can free a buffer (hdev->dump.head) before skb_put_data attempts to access it, leading to a vmalloc-out-of-bounds error and system crash. The vulnerability is rated High severity (CVSS 7.1), with a local attack vector and low attack complexity. A successful exploit could lead to a denial of service (system crash) and potentially information disclosure, though the primary impact is system unavailability. There is currently no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, indicating low public awareness.