CVE-2025-71082 — Bluetooth: btusb: revert use of devm_kzalloc in btusb

Back Back to CVE browser

HIGH

Bluetooth: btusb: revert use of devm_kzalloc in btusb

Published Jan 13, 2026

7.8

HIGH

CVSS 3.1

EPSS 0.14%

Description

This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file").

In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This ties the lifetime of all the btusb data to the binding of a driver to one interface, INTF. In a driver that binds to other interfaces, ISOC and DIAG, this is an accident waiting to happen.

The issue is revealed in btusb_disconnect(), where calling usb_driver_release_interface(&btusb_driver, data->intf) will have devm free the data that is also being used by the other interfaces of the driver that may not be released yet.

To fix this, revert the use of devm and go back to freeing memory explicitly.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  3.7
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <3.7
- Version
  5.15.198
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  6.1.160
  Status
  unaffected
  Constraints
  <=6.1.*
- Version
  6.12.64
  Status
  unaffected
  Constraints
  <=6.12.*
- Version
  6.18.4
  Status
  unaffected
  Constraints
  <=6.18.*
- Version
  6.19
  Status
  unaffected
  Constraints
  <=*
- Version
  6.6.120
  Status
  unaffected
  Constraints
  <=6.6.*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
3.7	affected	-
0	unaffected	<3.7
5.15.198	unaffected	<=5.15.*
6.1.160	unaffected	<=6.1.*
6.12.64	unaffected	<=6.12.*
6.18.4	unaffected	<=6.18.*
6.19	unaffected	<=*
6.6.120	unaffected	<=6.6.*

Red Hat Enterprise Linux 10

kernel

Fix deferred
Red Hat Enterprise Linux 6

kernel

Out of support scope
Red Hat Enterprise Linux 7

kernel

Affected
Red Hat Enterprise Linux 7

kernel-rt

Affected
Red Hat Enterprise Linux 8

kernel

Affected
Red Hat Enterprise Linux 8

kernel-rt

Affected
Red Hat Enterprise Linux 9

kernel

Fix deferred
Red Hat Enterprise Linux 9

kernel-rt

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 6	kernel	Out of support scope	n/a
Red Hat Enterprise Linux 7	kernel	Affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Affected	n/a
Red Hat Enterprise Linux 8	kernel	Affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Affected	n/a
Red Hat Enterprise Linux 9	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 9	kernel-rt	Fix deferred	n/a

Remediation

Red Hat statement

This affects systems with USB Bluetooth adapters. The issue occurs during Bluetooth disconnect operations when multiple interfaces are involved. The fix reverts to explicit memory management to properly handle multi-interface lifetimes.

Metrics

0.14% 0.00141

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00141

Score over time

Jan–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.14% (0.00141)	2.85th	v5 (v2026.06.15)
Jun 15, 2026	0.12% (0.00120)	2.16th	v5 (v2026.06.15)
Jan 14, 2026	0.02% (0.00018)	3.87th	v4 (v2025.03.14)

Weaknesses (1)

CWE-826

References (11)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2025-71082		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2429054		Issue Tracking
https://git.kernel.org/stable/c/1e54c19eaf84ba652c4e376571093e58e144b339		Patch
https://git.kernel.org/stable/c/252714f1e8bdd542025b16321c790458014d6880		Patch
https://git.kernel.org/stable/c/c0ecb3e4451fe94f4315e6d09c4046dfbc42090b		Patch
https://git.kernel.org/stable/c/cca0e9206e3bcc63cd3e72193e60149165d493cc		Patch
https://git.kernel.org/stable/c/fdf7c640fb8a44a59b0671143d8c2f738bc48003		Patch
https://git.kernel.org/stable/c/fff9206b0907252a41eb12b7c1407b9347df18b1		Patch
https://lore.kernel.org/linux-cve-announce/2026011339-CVE-2025-71082-ef8a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-71082
https://www.cve.org/CVERecord?id=CVE-2025-71082