In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcisync: fix race in hcicmdsyncdequeue_once
hcicmdsyncdequeueonce() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hcicmdsyncwork() can also delete the same entry, leading to double listdel() and "UAF".
Fix this by holding cmdsyncwork_lock across both lookup and cancel, so that the entry cannot be removed concurrently.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40318.json"
}