CVE-2025-38315

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: Check dsbr size from EFI variable

Since the size of struct btintel_dsbr is already known, we can just start there instead of querying the EFI variable size. If the final result doesnt match what we expect also fail. This fixes a stack buffer overflow when the EFI variable is larger than struct btintel_dsbr.

Weakness

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Software

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/230.html
• https://cwe.mitre.org/data/definitions/231.html

References

• https://git.kernel.org/stable/c/3aa1dc3c9060e335e82e9c182bf3d1db29220b1b
• https://git.kernel.org/stable/c/7b8526bb489780ccc0caffc446ecabec83cfe568
• https://git.kernel.org/stable/c/9427f6081f37c795a8bd29d0ee72a4da3bd64af8