What’s Vulnerable › Vulnerabilities

CVE-2025-22007: Bluetooth: Fix error code in chan_alloc_skb_cb()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-03 · updated 2026-06-17
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix error code in chan_alloc_skb_cb() The chan_alloc_skb_cb() function is supposed to return error pointers on error. Returning NULL will lead to a NULL dereference.

Affected products

• Linux kernel: from 3.17 before 6.1.132; from 6.2 before 6.6.85; from 6.7 before 6.12.21; from 6.13 before 6.13.9; 6.14-rc1, 6.14-rc2, 6.14-rc3, 6.14-rc4, 6.14-rc5, 6.14-rc6 (+1) — fixed in 6.1.132, 6.12.21, 6.13.9, 6.6.85

How to fix

Upgrade to a fixed version: Linux kernel 6.1.132, 6.12.21, 6.13.9, 6.6.85. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/1bd68db7beb426ab5a45d81516ed9611284affc8
• https://git.kernel.org/stable/c/72d061ee630d0dbb45c2920d8d19b3861c413e54
• https://git.kernel.org/stable/c/761b7c36addd22c7e6ceb05caaadc3b062d99faa
• https://git.kernel.org/stable/c/76304cba8cba12bb10d89d016c28403a2dd89a29
• https://git.kernel.org/stable/c/788ae2ae4cf484e248b5bc29211c7ac6510e3e92
• https://git.kernel.org/stable/c/a78692ec0d1e17a96b09f2349a028878f5b305e4
• https://git.kernel.org/stable/c/b3d607e36fef4bd05fb938a8a868ff70e9fedbe2
• https://git.kernel.org/stable/c/ecd06ad0823a90b4420c377ef8917e44e23ee841
• https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
• https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Get alerted when CVE-2025-22007 or the next vulnerability affects your stack