{"id":"CVE-2025-71082","revision":"be667abb4d274d28b2e31e390ed4a36d","records":[{"revision":"be667abb4d274d28b2e31e390ed4a36d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-71082","aliases":[],"title":"Bluetooth: btusb: revert use of devm_kzalloc in btusb","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: revert use of devm_kzalloc in btusb\n\nThis reverts commit 98921dbd00c4e (\"Bluetooth: Use devm_kzalloc in\nbtusb.c file\").\n\nIn btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This\nties the lifetime of all the btusb data to the binding of a driver to\none interface, INTF. In a driver that binds to other interfaces, ISOC\nand DIAG, this is an accident waiting to happen.\n\nThe issue is revealed in btusb_disconnect(), where calling\nusb_driver_release_interface(&btusb_driver, data->intf) will have devm\nfree the data that is also being used by the other interfaces of the\ndriver that may not be released yet.\n\nTo fix this, revert the use of devm and go back to freeing memory\nexplicitly.","state":0,"publishedAt":"2026-01-13T15:34:46.301+00:00","modifiedAt":"2026-10-19T18:15:11.277+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/bluetooth/btusb.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\",\n                            \"lessThan\": \"fff9206b0907252a41eb12b7c1407b9347df18b1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\",\n                            \"lessThan\": \"cca0e9206e3bcc63cd3e72193e60149165d493cc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\",\n                            \"lessThan\": \"c0ecb3e4451fe94f4315e6d09c4046dfbc42090b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\",\n                            \"lessThan\": \"1e54c19eaf84ba652c4e376571093e58e144b339\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\",\n                            \"lessThan\": \"fdf7c640fb8a44a59b0671143d8c2f738bc48003\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"98921dbd00c4e2e4bdd56423cb5edf98d57b45f7\",\n                            \"lessThan\": \"252714f1e8bdd542025b16321c790458014d6880\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/bluetooth/btusb.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.198\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.160\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.120\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.64\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.4\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/fff9206b0907252a41eb12b7c1407b9347df18b1","https://git.kernel.org/stable/c/cca0e9206e3bcc63cd3e72193e60149165d493cc","https://git.kernel.org/stable/c/c0ecb3e4451fe94f4315e6d09c4046dfbc42090b","https://git.kernel.org/stable/c/1e54c19eaf84ba652c4e376571093e58e144b339","https://git.kernel.org/stable/c/fdf7c640fb8a44a59b0671143d8c2f738bc48003","https://git.kernel.org/stable/c/252714f1e8bdd542025b16321c790458014d6880"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71082","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-71082","identifiers":["CVE-2025-71082"]},"retained":false,"historicalAffected":[]}],"coverage":[]}