In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending before write iter sends the cmd, just as syzbot reported in UAF[1]. Here we use hci_dev_lock to synchronize the two, thereby avoiding the UAF mentioned in [1]. [1] syzbot reported: BUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 Read of size 8 at addr ffff888077164818 by task syz.0.17/5989 Call Trace: mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Allocated by task 5989: mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296 set_link_security+0x557/0x710 net/bluetooth/mgmt.c:1910 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Freed by task 5991: mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257 mgmt_index_removed+0x112/0x2f0 net/bluetooth/mgmt.c:9477 hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:1143 advisory.

    * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting     (CVE-2025-38141)
      * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)
      * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)
      * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)
      * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)
      * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)
      * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)
      * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-1143 advisory.

    - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CKI Backport Bot) [RHEL-139462]     {CVE-2025-68305}
    - dm: fix dm_blk_report_zones (CKI Backport Bot) [RHEL-137949] {CVE-2025-38141}
    - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (CKI Backport Bot) [RHEL-136964]     {CVE-2025-40294}
    - drm/xe: Fix vm_bind_ioctl double free bug (CKI Backport Bot) [RHEL-122309] {CVE-2025-38731}
    - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139487]     {CVE-2025-68301}
    - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139284]     {CVE-2025-40248}
    - eventpoll: don't decrement ep refcount while still holding the ep mutex (CKI Backport Bot) [RHEL-138035]     {CVE-2025-38349}
    - mptcp: fix race condition in mptcp_schedule_work() (CKI Backport Bot) [RHEL-134448] {CVE-2025-40258}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:1143 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting     (CVE-2025-38141)

    * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)

    * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)

    * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)

    * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)

    * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)

    * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)

    * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition     between sock bind and socket write iter. bind may free the same cmd via mgmt_pending before write iter     sends the cmd, just as syzbot reported in UAF[1]. Here we use hci_dev_lock to synchronize the two, thereby     avoiding the UAF mentioned in [1]. [1] syzbot reported: BUG: KASAN: slab-use-after-free in     mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 Read of size 8 at addr ffff888077164818 by     task syz.0.17/5989 Call Trace: mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316     set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918 hci_mgmt_cmd+0x9c9/0xef0     net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839     sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742     sock_write_iter+0x279/0x360 net/socket.c:1195 Allocated by task 5989: mgmt_pending_add+0x35/0x140     net/bluetooth/mgmt_util.c:296 set_link_security+0x557/0x710 net/bluetooth/mgmt.c:1910     hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0     net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270     net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Freed by task 5991: mgmt_pending_free     net/bluetooth/mgmt_util.c:311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257     mgmt_index_removed+0x112/0x2f0 net/bluetooth/mgmt.c:9477 hci_sock_bind+0xbe9/0x1000     net/bluetooth/hci_sock.c:1314 (CVE-2025-68305)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
297205	AlmaLinux 9 : kernel (ALSA-2026:1143)	Nessus	Alma Linux Local Security Checks	high
297194	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2026:0315-1)	Nessus	SuSE Local Security Checks	high
296967	Oracle Linux 9 : kernel (ELSA-2026-1143)	Nessus	Oracle Linux Local Security Checks	high
296680	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2026:0293-1)	Nessus	SuSE Local Security Checks	high
296676	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0281-1)	Nessus	SuSE Local Security Checks	high
296624	RHEL 9 : kernel (RHSA-2026:1143)	Nessus	Red Hat Local Security Checks	high
296481	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0278-1)	Nessus	SuSE Local Security Checks	high
278777	Linux Distros Unpatched Vulnerability : CVE-2025-68305	Nessus	Misc.	high

Detections

Analytics

CVE-2025-68305

medium

Tenable Plugins

high

high

high

high

high

high

high

high