CVE-2025-71082

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This ties the lifetime of all the btusb data to the binding of a driver to one interface, INTF. In a driver that binds to other interfaces, ISOC and DIAG, this is an accident waiting to happen. The issue is revealed in btusb_disconnect(), where calling usb_driver_release_interface(&btusb_driver, data->intf) will have devm free the data that is also being used by the other interfaces of the driver that may not be released yet. To fix this, revert the use of devm and go back to freeing memory explicitly.

CVSS Details

CVSS Score

7.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel < 5.15 (affected commit 98921dbd00c4e introduced devm_kzalloc in btusb)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC for CVE-2025-71082
# Trigger use-after-free in btusb driver
# This is a conceptual PoC - actual exploitation requires specific conditions

import os
import subprocess

def trigger_uaf():
    """Attempt to trigger the use-after-free condition"""
    # The vulnerability occurs when:
    # 1. btusb driver binds to multiple interfaces (INTF, ISOC, DIAG)
    # 2. Disconnect is called on one interface
    # 3. devm frees the data while other interfaces still reference it
    
    # In practice, this would be triggered by:
    # - Plugging in a Bluetooth USB device
    # - The driver binds to multiple interfaces
    # - One interface is disconnected
    # - Other interfaces try to access freed memory
    
    print("CVE-2025-71082 - btusb use-after-free")
    print("This vulnerability is triggered through normal device disconnect")
    
    return True

if __name__ == "__main__":
    trigger_uaf()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-71082
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-71082
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-71082/
[4] VulDB https://vuldb.com/cve/CVE-2025-71082
[5] https://git.kernel.org/stable/c/1e54c19eaf84ba652c4e376571093e58e144b339
[6] https://git.kernel.org/stable/c/252714f1e8bdd542025b16321c790458014d6880
[7] https://git.kernel.org/stable/c/c0ecb3e4451fe94f4315e6d09c4046dfbc42090b
[8] https://git.kernel.org/stable/c/cca0e9206e3bcc63cd3e72193e60149165d493cc
[9] https://git.kernel.org/stable/c/fdf7c640fb8a44a59b0671143d8c2f738bc48003
[10] https://git.kernel.org/stable/c/fff9206b0907252a41eb12b7c1407b9347df18b1

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-71082", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-01-13T16:16:07.780", "lastModified": "2026-03-25T19:38:23.750", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: revert use of devm_kzalloc in btusb\n\nThis reverts commit 98921dbd00c4e (\"Bluetooth: Use devm_kzalloc in\nbtusb.c file\").\n\nIn btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This\nties the lifetime of all the btusb data to the binding of a driver to\none interface, INTF. In a driver that binds to other interfaces, ISOC\nand DIAG, this is an accident waiting to happen.\n\nThe issue is revealed in btusb_disconnect(), where calling\nusb_driver_release_interface(&btusb_driver, data->intf) will have devm\nfree the data that is also being used by the other interfaces of the\ndriver that may not be released yet.\n\nTo fix this, revert the use of devm and go back to freeing memory\nexplicitly."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: btusb: revertir el uso de devm_kzalloc en btusb\n\nEsto revierte el commit 98921dbd00c4e ('Bluetooth: Usar devm_kzalloc en el archivo btusb.c').\n\nEn btusb_probe(), usamos devm_kzalloc() para asignar los datos de btusb. Esto vincula la vida útil de todos los datos de btusb a la vinculación de un controlador a una interfaz, INTF. En un controlador que se vincula a otras interfaces, ISOC y DIAG, esto es un accidente a punto de ocurrir.\n\nEl problema se revela en btusb_disconnect(), donde llamar a usb_driver_release_interface(&btusb_driver, data->intf) hará que devm libere los datos que también están siendo utilizados por las otras interfaces del controlador que quizás aún no se hayan liberado.\n\nPara solucionar esto, se revierte el uso de devm y se vuelve a liberar la memoria explícitamente."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7.1", "versionEndExcluding": "5.15.198", "matchCriteriaId": "04178DFF-C064-47C6-B0FD-9D0B84808F0D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.160", "matchCriteriaId": "C10CC03E-16A9-428A-B449-40D3763E15F6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.120", "matchCriteriaId": "43C3A206-5EEE-417B-AA0F-EF8972E7A9F0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.64", "matchCriteriaId": "32BF4A52-377C-44ED-B5E6-7EA5D896E98B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.4", "matchCriteriaId": "DC988EA0-0E32-457A-BF95-89BEB31A227B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:3.7:-:*:*:*:*:*:*", "matchCriteriaId": "F482CC77-4452-423A-8A57-523E1AEA1087"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*", "matchCriteriaId": "EB5B7DFC-C36 ... (truncated)