Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 蓝牙MGMT修复可能的 UAF此操作尝试修复可能的 UAF由结构 mgmt_pending 在仍在处理时被释放可能造成的 UAF如下跟踪中所示这是为了修复 mgmt_pending_valid 被引入和使用以检查 mgmt_pending 是否已从 移除待定列表在完整的回调中用于检查此外在保持 mgmt_pending_lock 时从列表中删除 cmd以避免 TOCTOU 问题因为如果 cmd 留在列表上仍然可访问和释放它。BUG：
    KASAN在 mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 中在任务 kworker/u11:0/55 CPU: 0 UID: 0 PID: 55 Comm发生的对 addr ffff8880709d4dc0 上大小 8 的读取中存在 slab 使用后释放问题kworker/u11:0 未受感染 6.16.4 #2 PREEMPT(full) Hardware nameQEMU Standard PC (i440FX + PIIX, 1996)BIOS 1.10.2-1ubuntu1 04/01/2014 Workqueuehci0 hci_cmd_sync_work 调用追踪 <TASK> dump_stack_lvl+ 0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [内联] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c 595 mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xade/0x17queue.b0c kernel/workqueue.b0c :3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii /source/fuzzing/kernel/kasan/linux-6.16.4/arch/x86/entry/entry_64.S:245 </TASK> 由任务分配 12210kasan_save_stack mm/kasan/common.c:47 [内联] kasan_save_track+0x3e/ 0x80 mm/kasan/common.c:68毒害_kmalloc_redzone mm/kasan/common.c:377 [内联] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [内联] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4364 kmalloc_noprof include/linux/slab.h:905 [内联] kzalloc_noprof include/linux/slab.h:1039 [内联] mgmt_pending_new+0x65/0x1e0 net/bluetooth/mgmt_util.c ! /bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:714 [内联] __sock_sendmsg+0x219/0x270 net/socket.c:729 sock_write_iter+0x3258/0x3258/0x3258 net/socket.c:1133 new_sync_wri te fs/read_write.c:593 [内联] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [内联] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f 由任务释放 12221kasan_save_stack mm/kasan/common.c:47 [内联] kasan_save_track+0x3e/0x80 mm/kasan/common。 c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576毒害_slab_object mm/kasan/common.c:247 [内联] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan .h:233 [inline] slab_free_hook mm/slub.c:2381 [inline] slab_free mm/slub.c:4648 [inline] kfree+0x18e/0x440 mm/slub.c:4847 mgmt_pending_free net/bluetooth/mgmt_util.c 311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257
    __mgmt_power_off+0x169/0x350 net/bluetooth/mgmt.c:9444 hci_dev_close_sync+0x754/0x1330 net/bluetooth/hci_sync.c:5290 hci_dev_do_close net/bluetooth/hci_core.c:501 [inline] hci_dev_close+0x108/0x200 net/bluetooth/ hci_core.c:526 sock_do_ioctl+0xd9/0x300 net/socket.c:1192 sock_ioctl+0x576/0x790 net/socket.c:1313 vfs_ioctl fs/ioctl.c:51 [内联] __do_sys_ioctl fs/ioctl.c:907 [内联] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf ---truncated--- (CVE-2025-39981)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2025-39981

high Nessus 插件 ID 271563

版本 1.5