CVE-2025-40301
Published Dec 8, 2025
Modified Apr 15, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate skb length for unknown CC opcode In hci_cmd_complete_evt(), if the command complete event has an unknown opcode, we assume the first byte of the remaining skb->data contains the return status. However, parameter data has previously been pulled in hci_event_func(), which may leave the skb empty. If so, using skb->data[0] for the return status uses un-init memory. The fix is to check skb->len before using skb->data.
Is your site exposed to CVE-2025-40301?
Run a free security scan — no signup, results in seconds.
References
Other References
https://git.kernel.org/stable/c/1a0ddaaf97405dbd11d4cb5a961a3f82400e8a50
https://git.kernel.org/stable/c/5c5f1f64681cc889d9b13e4a61285e9e029d6ab5
https://git.kernel.org/stable/c/779f83a91d4f1bf5ddfeaf528420cbb6dbf03fa8
https://git.kernel.org/stable/c/cf2c2acec1cf456c3d11c11a7589e886a0f963a9
https://git.kernel.org/stable/c/fea895de78d3bb2f0c09db9f10b18f8121b15759
Frequently Asked Questions
What is CVE-2025-40301? +
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: validate skb length for unknown CC opcode
In hci_cmd_complete_evt(), if the command complete event has an unknown
opcode, we assume the first byte of the remaining skb->data contains the
return status. However, parameter data has previously been pulled in
hci_event_func(), which may leave the skb empty. If so, using skb->data[0]
for the return status uses un-init memory.
The fix is to check skb->len before using skb->data.
How do I check if I'm vulnerable to CVE-2025-40301? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.