cve 2025 40284

CVE-2025-40284 is a use-after-free vulnerability in the Linux Bluetooth management stack, specifically in the MGMT subsystem's handling of Bluetooth Mesh timers. When a host device (hdev) is removed, a delayed mesh-transmit completion timer could remain active, leading to a crash that may hang or take down affected systems. The fix, a one-line cancellation of the timer, aligns the code with defensive practices used for other timers. This issue is relevant to Linux-based systems acting as Bluetooth Mesh gateways or controllers. The tag covers discussion of the vulnerability, its impact, and the upstream patch.