CVE-2025-21969

一、漏洞信息
 漏洞编号：[CVE-2025-21969](https://nvd.nist.gov/vuln/detail/CVE-2025-21969)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.x分值：
  BaseScore：7.8 High
  Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmdAfter the hci sync command releases l2cap_conn, the hci receive data workqueue references the released l2cap_conn when sending to the upper layer.Add hci dev lock to the hci receive data work queue to synchronize the two.[1]BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024Workqueue: hci1 hci_rx_workCall Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline] l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954 l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline] l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817 hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline] hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>Allocated by task 5837: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860 l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726 hci_event_func net/bluetooth/hci_event.c:7473 [inline] hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525 hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244Freed by task 54: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266 hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entr---truncated---
 漏洞公开时间：2025-04-02 00:15:28
 漏洞创建时间：2025-04-02 01:12:28
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-21969
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7790a79c6fce8d5d552bc64f5c82819f719e4f28 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b4f82f9ed43aefa79bec2504ae8c29be0c0f5d1d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c96cce853542b3b13da3738f35ef1be8cfcc9d1d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f8094625a591eeb0b75b1bd9e713fac1d93f5ca9 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-21969 | https://bugzilla.suse.com/show_bug.cgi?id=1240784 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-21969 | https://bugzilla.suse.com/show_bug.cgi?id=1240784 |
| suse_bugzilla | https://git.kernel.org/stable/c/7790a79c6fce8d5d552bc64f5c82819f719e4f28 | https://bugzilla.suse.com/show_bug.cgi?id=1240784 |
| suse_bugzilla | https://git.kernel.org/stable/c/b4f82f9ed43aefa79bec2504ae8c29be0c0f5d1d | https://bugzilla.suse.com/show_bug.cgi?id=1240784 |
| suse_bugzilla | https://git.kernel.org/stable/c/c96cce853542b3b13da3738f35ef1be8cfcc9d1d | https://bugzilla.suse.com/show_bug.cgi?id=1240784 |
| suse_bugzilla | https://git.kernel.org/stable/c/f8094625a591eeb0b75b1bd9e713fac1d93f5ca9 | https://bugzilla.suse.com/show_bug.cgi?id=1240784 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2356633 | https://bugzilla.suse.com/show_bug.cgi?id=1240784 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-21969.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1240784 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2025-21969 |
| mageia |  | http://advisories.mageia.org/MGASA-2025-0142.html |
| osv | https://git.kernel.org/stable/c/7790a79c6fce8d5d552bc64f5c82819f719e4f28 | https://osv.dev/vulnerability/CVE-2025-21969 |
| osv | https://git.kernel.org/stable/c/b4f82f9ed43aefa79bec2504ae8c29be0c0f5d1d | https://osv.dev/vulnerability/CVE-2025-21969 |
| osv | https://git.kernel.org/stable/c/c96cce853542b3b13da3738f35ef1be8cfcc9d1d | https://osv.dev/vulnerability/CVE-2025-21969 |
| osv | https://git.kernel.org/stable/c/f8094625a591eeb0b75b1bd9e713fac1d93f5ca9 | https://osv.dev/vulnerability/CVE-2025-21969 |
| osv | https://security-tracker.debian.org/tracker/CVE-2025-21969 | https://osv.dev/vulnerability/CVE-2025-21969 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/7790a79c6fce8d5d552bc64f5c82819f719e4f28 |  | nvd |
|  |  | https://git.kernel.org/stable/c/b4f82f9ed43aefa79bec2504ae8c29be0c0f5d1d |  | nvd |
|  |  | https://git.kernel.org/stable/c/c96cce853542b3b13da3738f35ef1be8cfcc9d1d |  | nvd |
|  |  | https://git.kernel.org/stable/c/f8094625a591eeb0b75b1bd9e713fac1d93f5ca9 |  | nvd |
| linux_kernel | 6.6.84 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c96cce853542b3b13da3738f35ef1be8cfcc9d1dFixed |  | linuxkernelcves |
| linux_kernel | 6.12.20 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f8094625a591eeb0b75b1bd9e713fac1d93f5ca9Fixed |  | linuxkernelcves |
| linux_kernel | 6.13.8 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7790a79c6fce8d5d552bc64f5c82819f719e4f28Fixed |  | linuxkernelcves |
| linux_kernel | 6.14 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b4f82f9ed43aefa79bec2504ae8c29be0c0f5d1dPlease |  | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmdAfter the hci sync command releases l2cap_conn, the hci receive data workqueue references the released l2cap_conn when sending to the upper layer.Add hci dev lock to the hci receive data work queue to synchronize the two.[1]BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024Workqueue: hci1 hci_rx_workCall Trace:<TASK>__dump_stack lib/dump_stack.c:94 [inline]dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120print_address_description mm/kasan/report.c:378 [inline]print_report+0x169/0x550 mm/kasan/report.c:489kasan_report+0x143/0x180 mm/kasan/report.c:602l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040process_one_work kernel/workqueue.c:3229 [inline]process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310worker_thread+0x870/0xd30 kernel/workqueue.c:3391kthread+0x2f0/0x390 kernel/kthread.c:389ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244</TASK>Allocated by task 5837:kasan_save_stack mm/kasan/common.c:47 [inline]kasan_save_track+0x3f/0x80 mm/kasan/common.c:68poison_kmalloc_redzone mm/kasan/common.c:377 [inline]__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394kasan_kmalloc include/linux/kasan.h:260 [inline]__kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329kmalloc_noprof include/linux/slab.h:901 [inline]kzalloc_noprof include/linux/slab.h:1037 [inline]l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726hci_event_func net/bluetooth/hci_event.c:7473 [inline]hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035process_one_work kernel/workqueue.c:3229 [inline]process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310worker_thread+0x870/0xd30 kernel/workqueue.c:3391kthread+0x2f0/0x390 kernel/kthread.c:389ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244Freed by task 54:kasan_save_stack mm/kasan/common.c:47 [inline]kasan_save_track+0x3f/0x80 mm/kasan/common.c:68kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582poison_slab_object mm/kasan/common.c:247 [inline]__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264kasan_slab_free include/linux/kasan.h:233 [inline]slab_free_hook mm/slub.c:2353 [inline]slab_free mm/slub.c:4613 [inline]kfree+0x196/0x430 mm/slub.c:4761l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332process_one_work kernel/workqueue.c:3229 [inline]process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310worker_thread+0x870/0xd30 kernel/workqueue.c:3391kthread+0x2f0/0x390 kernel/kthread.c:389ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244The Linux kernel CVE team has assigned CVE-2025-21969 to this issue.
 openEuler评分：
  7.8
 Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-24.03-LTS-SP1(6.6.0):受影响
3.openEuler-24.03-LTS-SP2(6.6.0):受影响
4.openEuler-24.03-LTS-SP3(6.6.0):不受影响
5.master(6.12.33):不受影响
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响
7.openEuler-22.03-LTS-SP3(5.10.0):不受影响
8.openEuler-22.03-LTS-SP4(5.10.0):不受影响
9.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否
9.openEuler-24.03-LTS-SP3(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-24.03-LTS-SP2(6.6.0):正常修复
4.openEuler-24.03-LTS-SP3(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
8.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
9.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在

src-openEuler / kernel
Closed

Content Risk Flag

Comments (23)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-21969

Comments (23)

Search

src-openEuler / kernel
Closed