cve 2025 38303

CVE-2025-38303 is a Linux kernel vulnerability affecting the Bluetooth Extended Inquiry Response (EIR) advertising data path, specifically the eir_create_adv_data function. The flaw was patched upstream in July 2025. Microsoft's advisory confirms that Azure Linux images include the affected upstream Bluetooth code and states that the CVE/VEX/CSAF product mapping will be updated if additional Microsoft products are later found to contain the same component. This tag covers discussions about the vulnerability, its impact on Azure Linux, and Microsoft's response. Users interested in Linux kernel security, Bluetooth stack bugs, or Microsoft's handling of upstream vulnerabilities in Azure Linux will find relevant content here.