---
id: CVE-2025-38128
title: 'Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands

  In 'mgmt_hci_cmd_sync()', check whether the size of parameters passed
  in 'struct mgmt_cp_hci_cmd_sync' matches …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 827af4787e74e8df9e8e0677a69fbb15e0856d2f <
    9eeafd16d76a7642d12b3442a26c15cd345e12f7
  - >-
    Linux >= 827af4787e74e8df9e8e0677a69fbb15e0856d2f <
    03f1700b9b4d4f2fed3165370f3c23db76553178
  - Linux 6.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:50:10.502436Z'
published: '2025-07-03'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:52:16.965Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38128'
references:
  - url: 'https://git.kernel.org/stable/c/9eeafd16d76a7642d12b3442a26c15cd345e12f7'
  - url: 'https://git.kernel.org/stable/c/03f1700b9b4d4f2fed3165370f3c23db76553178'
tags:
  - cve.org
epss: 0.00163
epssPercentile: 0.05574
ingestedAt: '2026-11-05T22:38:31.922Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands

In 'mgmt_hci_cmd_sync()', check whether the size of parameters passed
in 'struct mgmt_cp_hci_cmd_sync' matches the total size of the data
(i.e. 'sizeof(struct mgmt_cp_hci_cmd_sync)' plus trailing bytes).
Otherwise, large invalid 'params_len' will cause 'hci_cmd_sync_alloc()'
to do 'skb_put_data()' from an area beyond the one actually passed to
'mgmt_hci_cmd_sync()'.

## Affected

- `Linux >= 827af4787e74e8df9e8e0677a69fbb15e0856d2f < 9eeafd16d76a7642d12b3442a26c15cd345e12f7`
- `Linux >= 827af4787e74e8df9e8e0677a69fbb15e0856d2f < 03f1700b9b4d4f2fed3165370f3c23db76553178`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.