{
  "cveId": "CVE-2025-68304",
  "url": "https://patchblox.com/security/cve/CVE-2025-68304",
  "summary": "CVE-2025-68304 is fixed in linux on 1 platform by DEBIAN-CVE-2025-68304 (version 6.17.11-1), released December 16, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Bluetooth: hci_core: lookup hci_conn on RX path on protocol side",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: hci_core: lookup hci_conn on RX path on protocol side  The hdev lock/lookup/unlock/use pattern in the packet RX path doesn\u0027t ensure hci_conn* is not concurrently modified/deleted. This locking appears to be leftover from before conn_hash started using RCU commit bf4c63252490b (\u0022Bluetooth: convert conn hash to RCU\u0022) and not clear if it had purpose since then.  Currently, there are code paths that delete hci_conn* from elsewhere than the ordered hdev-\u003Eworkqueue where the RX work runs in. E.g. commit 5af1f84ed13a (\u0022Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync\u0022) introduced some of these, and there probably were a few others before it.  It\u0027s better to do the locking so that even if these run concurrently no UAF is possible.  Move the lookup of hci_conn and associated socket-specific conn to protocol recv handlers, and do them within a single critical section to cover hci_conn* usage and lookup.  syzkaller has reported a crash that appears to be this issue:      [Task hdev-\u003Eworkqueue]          [Task 2]                                     hci_disconnect_all_sync     l2cap_recv_acldata(hcon)                                       hci_conn_get(hcon)                                       hci_abort_conn_sync(hcon)                                         hci_dev_lock       hci_dev_lock                                         hci_conn_del(hcon)       v-------------------------------- hci_dev_unlock                                       hci_conn_put(hcon)       conn = hcon-\u003El2cap_data (UAF)",
  "published": "2025-12-16T16:16:09Z",
  "severity": "Important",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00233,
  "epssPercentile": 0.14224,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-68304",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.17.11-1",
      "fix": "DEBIAN-CVE-2025-68304",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-68304",
      "released": "2025-12-16T16:16:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}