CVE-2025-21936

Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()

State: Published
Severity: 5.5 Medium
Published: Apr 1, 2025
Updated: May 11, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()

Add check for the return value of mgmt_alloc_skb() in mgmt_device_connected() to prevent null pointer dereference.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	e96741437ef0a5d18144e790ac894397efda0924 to before dc516e66fb28c61b248b393e2ddd63bd7f104969Affected e96741437ef0a5d18144e790ac894397efda0924 to before bdb1805c248e9694dbb3ffa8867cef2e52cf7261Affected e96741437ef0a5d18144e790ac894397efda0924 to before 7841180342c9a0fd97d54f3e62c7369309b5cd84Affected e96741437ef0a5d18144e790ac894397efda0924 to before 7d39387886ffe220323cbed5c155233c3276926bAffected e96741437ef0a5d18144e790ac894397efda0924 to before d8df010f72b8a32aaea393e36121738bb53ed905Affected
LinuxLinux	5.17Affected before 5.17Not affected 6.1.131 through 6.1.Not affected 6.6.83 through 6.6.Not affected 6.12.19 through 6.12.Not affected 6.13.7 through 6.13.Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

e96741437ef0a5d18144e790ac894397efda0924 to before dc516e66fb28c61b248b393e2ddd63bd7f104969Affected
e96741437ef0a5d18144e790ac894397efda0924 to before bdb1805c248e9694dbb3ffa8867cef2e52cf7261Affected
e96741437ef0a5d18144e790ac894397efda0924 to before 7841180342c9a0fd97d54f3e62c7369309b5cd84Affected
e96741437ef0a5d18144e790ac894397efda0924 to before 7d39387886ffe220323cbed5c155233c3276926bAffected
e96741437ef0a5d18144e790ac894397efda0924 to before d8df010f72b8a32aaea393e36121738bb53ed905Affected

LinuxLinux

5.17Affected
before 5.17Not affected
6.1.131 through 6.1.*Not affected
6.6.83 through 6.6.*Not affected
6.12.19 through 6.12.*Not affected
6.13.7 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.