{"id":"CVE-2025-38593","summary":"Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'\n\nFunction 'hci_discovery_filter_clear()' frees 'uuids' array and then\nsets it to NULL. There is a tiny chance of the following race:\n\n'hci_cmd_sync_work()'\n\n 'update_passive_scan_sync()'\n\n   'hci_update_passive_scan_sync()'\n\n     'hci_discovery_filter_clear()'\n       kfree(uuids);\n\n       \u003c-------------------------preempted--------------------------------\u003e\n                                           'start_service_discovery()'\n\n                                             'hci_discovery_filter_clear()'\n                                               kfree(uuids); // DOUBLE FREE\n\n       \u003c-------------------------preempted--------------------------------\u003e\n\n      uuids = NULL;\n\nTo fix it let's add locking around 'kfree()' call and NULL pointer\nassignment. Otherwise the following backtrace fires:\n\n[ ] ------------[ cut here ]------------\n[ ] kernel BUG at mm/slub.c:547!\n[ ] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\n[ ] CPU: 3 UID: 0 PID: 246 Comm: bluetoothd Tainted: G O 6.12.19-kernel #1\n[ ] Tainted: [O]=OOT_MODULE\n[ ] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ ] pc : __slab_free+0xf8/0x348\n[ ] lr : __slab_free+0x48/0x348\n...\n[ ] Call trace:\n[ ]  __slab_free+0xf8/0x348\n[ ]  kfree+0x164/0x27c\n[ ]  start_service_discovery+0x1d0/0x2c0\n[ ]  hci_sock_sendmsg+0x518/0x924\n[ ]  __sock_sendmsg+0x54/0x60\n[ ]  sock_write_iter+0x98/0xf8\n[ ]  do_iter_readv_writev+0xe4/0x1c8\n[ ]  vfs_writev+0x128/0x2b0\n[ ]  do_writev+0xfc/0x118\n[ ]  __arm64_sys_writev+0x20/0x2c\n[ ]  invoke_syscall+0x68/0xf0\n[ ]  el0_svc_common.constprop.0+0x40/0xe0\n[ ]  do_el0_svc+0x1c/0x28\n[ ]  el0_svc+0x30/0xd0\n[ ]  el0t_64_sync_handler+0x100/0x12c\n[ ]  el0t_64_sync+0x194/0x198\n[ ] Code: 8b0002e6 eb17031f 54fffbe1 d503201f (d4210000)\n[ ] ---[ end trace 0000000000000000 ]---","modified":"2026-04-02T12:48:02.731368Z","published":"2025-08-19T17:03:18.960Z","related":["SUSE-SU-2025:03600-1","SUSE-SU-2025:03601-1","SUSE-SU-2025:03602-1","SUSE-SU-2025:03633-1","SUSE-SU-2025:03634-1","SUSE-SU-2025:20851-1","SUSE-SU-2025:20861-1","SUSE-SU-2025:20870-1","SUSE-SU-2025:20898-1","SUSE-SU-2025:21074-1","SUSE-SU-2025:21139-1","SUSE-SU-2025:21179-1","SUSE-SU-2025:3725-1","SUSE-SU-2025:3751-1","openSUSE-SU-2025:20081-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38593.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/16852eccbdfaf41a666705e3f8be55cf2864c5ca"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2935e556850e9c94d7a00adf14d3cd7fe406ac03"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7ce9bb0b95fc280e9212b8922590c492ca1d9c39"},{"type":"WEB","url":"https://git.kernel.org/stable/c/86f3dcd1f331cfd4fd7ec88906955134ec51afbe"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a351ff6b8ecca4229afaa0d98042bead8de64799"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f8069f34c4c976786ded97498012225af87435d7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38593.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38593"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ad383c2c65a5baf16e334cd40a013cc302176891"},{"fixed":"86f3dcd1f331cfd4fd7ec88906955134ec51afbe"},{"fixed":"7ce9bb0b95fc280e9212b8922590c492ca1d9c39"},{"fixed":"16852eccbdfaf41a666705e3f8be55cf2864c5ca"},{"fixed":"a351ff6b8ecca4229afaa0d98042bead8de64799"},{"fixed":"f8069f34c4c976786ded97498012225af87435d7"},{"fixed":"2935e556850e9c94d7a00adf14d3cd7fe406ac03"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38593.json"}}],"schema_version":"1.7.5"}