CVE-2025-40294

10

FAUCET Score

CVE-2025-40294 is an out-of-bounds (OOB) access vulnerability in the Linux kernel's Bluetooth subsystem, specifically within the parse_adv_monitor_pattern() function. This flaw occurs when user-supplied input for advertisement patterns exceeds the allocated buffer size, potentially leading to memory corruption. While no CVSS score is provided, the FAUCET Risk Score is 7/100, indicating a low to moderate severity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 6.1.83, < 6.1.159CPE match	cpe:2.3:a:linux:linux_kernel::::::::

CVSS Data

CVSS data has not been published for this CVE.

Exploit Intelligence

EPSS Score

0.18%

Probability of exploitation in next 30 days

EPSS Percentile

7.7%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

Social Chatter

No social media mentions found for this CVE.

Media Mentions

Remediation

Patch Available

Vendor Patches (37)

microsoftpatch availablevia msrc

Product: azl3 kernel 6.6.112.1-2 on Azure Linux 3.0Fixed in: 6.6.117.1-1

microsoftpatch availablevia msrc

Product: 20613-17084Fixed in: 6.6.117.1-1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.6 Extended Update SupportFixed in: kernel-0:5.14.0-570.86.1.el9_6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: kernel-0:5.14.0-611.26.1.el9_7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: kernel-0:5.14.0-427.110.1.el9_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 10.0 Extended Update SupportFixed in: kernel-0:6.12.0-55.60.1.el10_0

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 10Fixed in: kernel-0:6.12.0-124.31.1.el10_1

ubuntupatch availablevia ubuntu_usn

Product: linux-gcp-6.8 (jammy)Fixed in: 6.8.0-1052.55~22.04.1

ubuntupatch availablevia ubuntu_usn

Product: linux-hwe-6.8 (jammy)Fixed in: 6.8.0-106.106~22.04.1

ubuntupatch availablevia ubuntu_usn

Product: linux-ibm-6.8 (jammy)Fixed in: 6.8.0-1049.49~22.04.1

ubuntupatch availablevia ubuntu_usn

Product: linux-lowlatency-hwe-6.8 (jammy)Fixed in: 6.8.0-106.106.1~22.04.1

ubuntupatch availablevia ubuntu_usn

Product: linux-oracle-6.8 (jammy)Fixed in: 6.8.0-1047.48~22.04.1

ubuntupatch availablevia ubuntu_usn

Product: linux-azure (questing)Fixed in: 6.17.0-1008.8

ubuntupatch availablevia ubuntu_usn

Product: linux-aws (noble)Fixed in: 6.8.0-1050.53

ubuntupatch availablevia ubuntu_usn

Product: linux-gcp (noble)Fixed in: 6.8.0-1052.55

ubuntupatch availablevia ubuntu_usn

Product: linux-gke (noble)Fixed in: 6.8.0-1048.53

ubuntupatch availablevia ubuntu_usn

Product: linux-gkeop (noble)Fixed in: 6.8.0-1035.38

ubuntupatch availablevia ubuntu_usn

Product: linux-ibm (noble)Fixed in: 6.8.0-1049.49

ubuntupatch availablevia ubuntu_usn

Product: linux-lowlatency (noble)Fixed in: 6.8.0-106.106.1

ubuntupatch availablevia ubuntu_usn

Product: linux-oracle (noble)Fixed in: 6.8.0-1047.48

ubuntupatch availablevia ubuntu_usn

Product: linux-realtime-6.8 (jammy)Fixed in: 6.8.1-1045.46~22.04.1

ubuntupatch availablevia ubuntu_usn

Product: linux-realtime (noble)Fixed in: 6.8.1-1045.46

ubuntupatch availablevia ubuntu_usn

Product: linux-aws-6.8 (jammy)Fixed in: 6.8.0-1050.53~22.04.1

ubuntupatch availablevia ubuntu_usn

Product: linux-azure-6.8 (jammy)Fixed in: 6.8.0-1051.57~22.04.1

ubuntupatch availablevia ubuntu_usn

Product: linux-azure (noble)Fixed in: 6.8.0-1051.57

ubuntupatch availablevia ubuntu_usn

Product: linux-xilinx (noble)Fixed in: 6.8.0-1029.30

ubuntupatch availablevia ubuntu_usn

Product: linux-raspi (noble)Fixed in: 6.8.0-1050.54

ubuntupatch availablevia ubuntu_usn

Product: linux-raspi-realtime (noble)Fixed in: 6.8.0-2040.41

ubuntupatch availablevia ubuntu_usn

Product: linux-azure-fips (noble)Fixed in: 6.8.0-1052.58+fips1

ubuntupatch availablevia ubuntu_usn

Product: linux (noble)Fixed in: 6.8.0-106.106

ubuntupatch availablevia ubuntu_usn

Product: linux-aws-fips (noble)Fixed in: 6.8.0-1050.53+fips1

ubuntupatch availablevia ubuntu_usn

Product: linux-fips (noble)Fixed in: 6.8.0-106.106+fips1

ubuntupatch availablevia ubuntu_usn

Product: linux-gcp-fips (noble)Fixed in: 6.8.0-1052.55+fips1

ubuntupatch availablevia ubuntu_usn

Product: linux-nvidia-6.8 (jammy)Fixed in: 6.8.0-1049.52~22.04.1

ubuntupatch availablevia ubuntu_usn

Product: linux-nvidia (noble)Fixed in: 6.8.0-1049.52

ubuntupatch availablevia ubuntu_usn

Product: linux-nvidia-lowlatency (noble)Fixed in: 6.8.0-1049.52.1

redhatno patchvia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: kernel-rt

Vendor Advisories (13)

ubuntuUSN-8261-1

Linux kernel (Xilinx) vulnerabilities

ubuntuUSN-8165-1

Linux kernel (Azure FIPS) vulnerabilities

ubuntuUSN-8095-5

Linux kernel (Raspberry Pi) vulnerabilities

ubuntuUSN-8126-1

Linux kernel (Azure) vulnerabilities

ubuntuUSN-8125-1

Linux kernel (Azure) vulnerabilities

ubuntuUSN-8095-4

Linux kernel (AWS) vulnerabilities

ubuntuUSN-8095-3

Linux kernel (Real-time) vulnerabilities

ubuntuUSN-8095-2

Linux kernel (FIPS) vulnerabilities

ubuntuUSN-8100-1

Linux kernel (NVIDIA) vulnerabilities

ubuntuUSN-8095-1

Linux kernel vulnerabilities

ubuntuUSN-8029-3

Linux kernel (Azure) vulnerabilities

microsoft2025-Dec/CVE-2025-40294Moderate

Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()

redhatCVE-2025-40294Moderate

kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and denial of service

References

git.kernel.org / stable/c/3a50d59b3781bc3a4e96533612509546a4c309a7

git.kernel.org / stable/c/4b7d4aa5399b5a64caee639275615c63c008540d

git.kernel.org / stable/c/5f7350ff2b179764a4f40ba4161b60b8aaef857b

git.kernel.org / stable/c/8d59fba49362c65332395789fd82771f1028d87e

git.kernel.org / stable/c/96616530f524a0a76248cd44201de0a9e8526190