CVE-2025-40213: Linux

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to memcpy from badly declared on-stack flexible array. Another crash is in set_mesh_complete() due to double list_del via mgmt_pending_valid + mgmt_pending_remove. Use DEFINE_FLEX to declare the flexible array right, and don't memcpy outside bounds. As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free, and also report status on error.

Affected products

• Linux Linux: from 6.6.140, before 6.7 (fixed in 6.7); from 6.16.10, before 6.17 (fixed in 6.17); from 6.17, before 6.17.8 (fixed in 6.17.8)

Published 2025-11-24. Last modified 2026-07-30.