CVE-2025-21969

Summary

CVE-2025-21969 is a vulnerability affecting the Linux kernel's Bluetooth L2CAP subsystem. A use-after-free issue was discovered in the l2cap_send_cmd function. After the hci sync command releases an l2cap_conn object, the hci receive data workqueue references the released object when sending data to the upper layer. This results in a slab memory corruption, leading to a kernel crash. The vulnerability can be triggered by maliciously crafted Bluetooth data packets, potentially allowing an attacker to execute arbitrary code. The issue has been addressed by syncing the two structures using an hci dev lock in the hci receive data workqueue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.