CVE-2025-71082 (GCVE-0-2025-71082)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:34 – Updated: 2026-08-05 12:11
VLAI
Title
Bluetooth: btusb: revert use of devm_kzalloc in btusb
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This ties the lifetime of all the btusb data to the binding of a driver to one interface, INTF. In a driver that binds to other interfaces, ISOC and DIAG, this is an accident waiting to happen. The issue is revealed in btusb_disconnect(), where calling usb_driver_release_interface(&btusb_driver, data->intf) will have devm free the data that is also being used by the other interfaces of the driver that may not be released yet. To fix this, revert the use of devm and go back to freeing memory explicitly.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 98921dbd00c4e2e4bdd56423cb5edf98d57b45f7 , < fff9206b0907252a41eb12b7c1407b9347df18b1 (git)
Affected: 98921dbd00c4e2e4bdd56423cb5edf98d57b45f7 , < cca0e9206e3bcc63cd3e72193e60149165d493cc (git)
Affected: 98921dbd00c4e2e4bdd56423cb5edf98d57b45f7 , < c0ecb3e4451fe94f4315e6d09c4046dfbc42090b (git)
Affected: 98921dbd00c4e2e4bdd56423cb5edf98d57b45f7 , < 1e54c19eaf84ba652c4e376571093e58e144b339 (git)
Affected: 98921dbd00c4e2e4bdd56423cb5edf98d57b45f7 , < fdf7c640fb8a44a59b0671143d8c2f738bc48003 (git)
Affected: 98921dbd00c4e2e4bdd56423cb5edf98d57b45f7 , < 252714f1e8bdd542025b16321c790458014d6880 (git)
Create a notification for this product.
Linux Linux Affected: 3.7
Unaffected: 0 , < 3.7 (semver)
Unaffected: 5.15.198 , ≤ 5.15.* (semver)
Unaffected: 6.1.160 , ≤ 6.1.* (semver)
Unaffected: 6.6.120 , ≤ 6.6.* (semver)
Unaffected: 6.12.64 , ≤ 6.12.* (semver)
Unaffected: 6.18.4 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71082",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:23.595912Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:11.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btusb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fff9206b0907252a41eb12b7c1407b9347df18b1",
              "status": "affected",
              "version": "98921dbd00c4e2e4bdd56423cb5edf98d57b45f7",
              "versionType": "git"
            },
            {
              "lessThan": "cca0e9206e3bcc63cd3e72193e60149165d493cc",
              "status": "affected",
              "version": "98921dbd00c4e2e4bdd56423cb5edf98d57b45f7",
              "versionType": "git"
            },
            {
              "lessThan": "c0ecb3e4451fe94f4315e6d09c4046dfbc42090b",
              "status": "affected",
              "version": "98921dbd00c4e2e4bdd56423cb5edf98d57b45f7",
              "versionType": "git"
            },
            {
              "lessThan": "1e54c19eaf84ba652c4e376571093e58e144b339",
              "status": "affected",
              "version": "98921dbd00c4e2e4bdd56423cb5edf98d57b45f7",
              "versionType": "git"
            },
            {
              "lessThan": "fdf7c640fb8a44a59b0671143d8c2f738bc48003",
              "status": "affected",
              "version": "98921dbd00c4e2e4bdd56423cb5edf98d57b45f7",
              "versionType": "git"
            },
            {
              "lessThan": "252714f1e8bdd542025b16321c790458014d6880",
              "status": "affected",
              "version": "98921dbd00c4e2e4bdd56423cb5edf98d57b45f7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btusb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.4",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: revert use of devm_kzalloc in btusb\n\nThis reverts commit 98921dbd00c4e (\"Bluetooth: Use devm_kzalloc in\nbtusb.c file\").\n\nIn btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This\nties the lifetime of all the btusb data to the binding of a driver to\none interface, INTF. In a driver that binds to other interfaces, ISOC\nand DIAG, this is an accident waiting to happen.\n\nThe issue is revealed in btusb_disconnect(), where calling\nusb_driver_release_interface(\u0026btusb_driver, data-\u003eintf) will have devm\nfree the data that is also being used by the other interfaces of the\ndriver that may not be released yet.\n\nTo fix this, revert the use of devm and go back to freeing memory\nexplicitly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A local process with write access to the USB device node can use USBFS ioctls to disconnect a chosen btusb sibling interface; Bluetooth radio packets do not directly reach this teardown path.\nAC:L - The attacker can select the sibling interface and synchronously initiate unbinding, controlling the harmful teardown order without winning an uncontrollable race.\nPR:L - A basic local user with delegated write access to the USB device node is sufficient because the USBFS disconnect path contains no capability check.\nUI:N - The attacker can issue the disconnect ioctl directly without any action by another user.\nS:U - The use-after-free compromises the host kernel within the same security authority and does not inherently cross a VM or IOMMU boundary.\nC:H - The freed shared btusb object contains numerous kernel pointers, anchors, and callback pointers; reclaiming it can provide powerful disclosure primitives.\nI:H - Reuse of the freed object can corrupt pointer-rich kernel state or redirect callback execution, making arbitrary kernel modification or code execution defensible.\nA:H - The use-after-free can cause a kernel oops or panic during interface teardown and can be triggered repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:56.554Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fff9206b0907252a41eb12b7c1407b9347df18b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/cca0e9206e3bcc63cd3e72193e60149165d493cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0ecb3e4451fe94f4315e6d09c4046dfbc42090b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e54c19eaf84ba652c4e376571093e58e144b339"
        },
        {
          "url": "https://git.kernel.org/stable/c/fdf7c640fb8a44a59b0671143d8c2f738bc48003"
        },
        {
          "url": "https://git.kernel.org/stable/c/252714f1e8bdd542025b16321c790458014d6880"
        }
      ],
      "title": "Bluetooth: btusb: revert use of devm_kzalloc in btusb",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71082",
    "datePublished": "2026-01-13T15:34:46.301Z",
    "dateReserved": "2026-01-13T15:30:19.648Z",
    "dateUpdated": "2026-08-05T12:11:56.554Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71082",
      "date": "2026-08-05",
      "epss": "0.0012",
      "percentile": "0.02169"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:19:21.000Z",
      "cve": "CVE-2025-71082",
      "id": "msrc_CVE-2025-71082",
      "initial_release_date": "2026-01-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: btusb: revert use of devm_kzalloc in btusb",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2025-71082.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-71082\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:16:07.780\",\"lastModified\":\"2026-07-30T06:24:49.390\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: btusb: revert use of devm_kzalloc in btusb\\n\\nThis reverts commit 98921dbd00c4e (\\\"Bluetooth: Use devm_kzalloc in\\nbtusb.c file\\\").\\n\\nIn btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This\\nties the lifetime of all the btusb data to the binding of a driver to\\none interface, INTF. In a driver that binds to other interfaces, ISOC\\nand DIAG, this is an accident waiting to happen.\\n\\nThe issue is revealed in btusb_disconnect(), where calling\\nusb_driver_release_interface(\u0026btusb_driver, data-\u003eintf) will have devm\\nfree the data that is also being used by the other interfaces of the\\ndriver that may not be released yet.\\n\\nTo fix this, revert the use of devm and go back to freeing memory\\nexplicitly.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nBluetooth: btusb: revertir el uso de devm_kzalloc en btusb\\n\\nEsto revierte el commit 98921dbd00c4e (\u0027Bluetooth: Usar devm_kzalloc en el archivo btusb.c\u0027).\\n\\nEn btusb_probe(), usamos devm_kzalloc() para asignar los datos de btusb. Esto vincula la vida \u00fatil de todos los datos de btusb a la vinculaci\u00f3n de un controlador a una interfaz, INTF. En un controlador que se vincula a otras interfaces, ISOC y DIAG, esto es un accidente a punto de ocurrir.\\n\\nEl problema se revela en btusb_disconnect(), donde llamar a usb_driver_release_interface(\u0026amp;btusb_driver, data-\u0026gt;intf) har\u00e1 que devm libere los datos que tambi\u00e9n est\u00e1n siendo utilizados por las otras interfaces del controlador que quiz\u00e1s a\u00fan no se hayan liberado.\\n\\nPara solucionar esto, se revierte el uso de devm y se vuelve a liberar la memoria expl\u00edcitamente.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/bluetooth/btusb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\",\"lessThan\":\"fff9206b0907252a41eb12b7c1407b9347df18b1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\",\"lessThan\":\"cca0e9206e3bcc63cd3e72193e60149165d493cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\",\"lessThan\":\"c0ecb3e4451fe94f4315e6d09c4046dfbc42090b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\",\"lessThan\":\"1e54c19eaf84ba652c4e376571093e58e144b339\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\",\"lessThan\":\"fdf7c640fb8a44a59b0671143d8c2f738bc48003\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\",\"lessThan\":\"252714f1e8bdd542025b16321c790458014d6880\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/bluetooth/btusb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.198\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.160\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.120\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.64\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.4\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T20:41:23.595912Z\",\"id\":\"CVE-2025-71082\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.7.1\",\"versionEndExcluding\":\"5.15.198\",\"matchCriteriaId\":\"04178DFF-C064-47C6-B0FD-9D0B84808F0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.160\",\"matchCriteriaId\":\"C10CC03E-16A9-428A-B449-40D3763E15F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.120\",\"matchCriteriaId\":\"43C3A206-5EEE-417B-AA0F-EF8972E7A9F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.64\",\"matchCriteriaId\":\"32BF4A52-377C-44ED-B5E6-7EA5D896E98B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.4\",\"matchCriteriaId\":\"DC988EA0-0E32-457A-BF95-89BEB31A227B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.7:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"F482CC77-4452-423A-8A57-523E1AEA1087\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB5B7DFC-C36B-45D8-922C-877569FDDF43\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1e54c19eaf84ba652c4e376571093e58e144b339\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/252714f1e8bdd542025b16321c790458014d6880\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c0ecb3e4451fe94f4315e6d09c4046dfbc42090b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cca0e9206e3bcc63cd3e72193e60149165d493cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fdf7c640fb8a44a59b0671143d8c2f738bc48003\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fff9206b0907252a41eb12b7c1407b9347df18b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:02:11+00:00",
      "cve": "CVE-2025-71082",
      "id": "CVE-2025-71082",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71082.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-15T05:45:46Z",
      "cve": "CVE-2025-71082",
      "id": "CVE-2025-71082",
      "initial_release_date": "2026-01-14T00:25:44Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "620",
      "product_status:known_not_affected": "9",
      "product_status:recommended": "310",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-71082",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-71082.json",
      "version": "31"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-71082\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:41:23.595912Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:38:18.846Z\"}}], \"cna\": {\"title\": \"Bluetooth: btusb: revert use of devm_kzalloc in btusb\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\", \"lessThan\": \"fff9206b0907252a41eb12b7c1407b9347df18b1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\", \"lessThan\": \"cca0e9206e3bcc63cd3e72193e60149165d493cc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\", \"lessThan\": \"c0ecb3e4451fe94f4315e6d09c4046dfbc42090b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\", \"lessThan\": \"1e54c19eaf84ba652c4e376571093e58e144b339\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\", \"lessThan\": \"fdf7c640fb8a44a59b0671143d8c2f738bc48003\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\", \"lessThan\": \"252714f1e8bdd542025b16321c790458014d6880\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/bluetooth/btusb.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.198\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.160\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.64\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/bluetooth/btusb.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/fff9206b0907252a41eb12b7c1407b9347df18b1\"}, {\"url\": \"https://git.kernel.org/stable/c/cca0e9206e3bcc63cd3e72193e60149165d493cc\"}, {\"url\": \"https://git.kernel.org/stable/c/c0ecb3e4451fe94f4315e6d09c4046dfbc42090b\"}, {\"url\": \"https://git.kernel.org/stable/c/1e54c19eaf84ba652c4e376571093e58e144b339\"}, {\"url\": \"https://git.kernel.org/stable/c/fdf7c640fb8a44a59b0671143d8c2f738bc48003\"}, {\"url\": \"https://git.kernel.org/stable/c/252714f1e8bdd542025b16321c790458014d6880\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: btusb: revert use of devm_kzalloc in btusb\\n\\nThis reverts commit 98921dbd00c4e (\\\"Bluetooth: Use devm_kzalloc in\\nbtusb.c file\\\").\\n\\nIn btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This\\nties the lifetime of all the btusb data to the binding of a driver to\\none interface, INTF. In a driver that binds to other interfaces, ISOC\\nand DIAG, this is an accident waiting to happen.\\n\\nThe issue is revealed in btusb_disconnect(), where calling\\nusb_driver_release_interface(\u0026btusb_driver, data-\u003eintf) will have devm\\nfree the data that is also being used by the other interfaces of the\\ndriver that may not be released yet.\\n\\nTo fix this, revert the use of devm and go back to freeing memory\\nexplicitly.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.198\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.160\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.120\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.64\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.4\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19\", \"versionStartIncluding\": \"3.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T21:54:23.734Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-71082\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-11T18:44:11.870Z\", \"dateReserved\": \"2026-01-13T15:30:19.648Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-01-13T15:34:46.301Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.