---
id: CVE-2025-38303
title: 'Bluetooth: eir: Fix possible crashes on eir_create_adv_data'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: eir: Fix possible crashes on eir_create_adv_data

  eir_create_adv_data may attempt to add EIR_FLAGS and EIR_TX_POWER
  without checking if that would fit.
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 01ce70b0a274bd76a5a311fb90d4d446d9bdfea1 <
    2d4588f55cc10fc228f3b46469dbfb3f0a8b13c8
  - >-
    Linux >= 01ce70b0a274bd76a5a311fb90d4d446d9bdfea1 <
    e98ce4b70beab73563d82bd21821024140e6da06
  - >-
    Linux >= 01ce70b0a274bd76a5a311fb90d4d446d9bdfea1 <
    2af40d795d3fb0ee5c074b7ac56ab22402aa6e4f
  - >-
    Linux >= 01ce70b0a274bd76a5a311fb90d4d446d9bdfea1 <
    b9db0c27e73b7c8a19384a44af527edfda74ff3d
  - >-
    Linux >= 01ce70b0a274bd76a5a311fb90d4d446d9bdfea1 <
    47c03902269aff377f959dc3fd94a9733aa31d6e
  - Linux 5.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:49:29.846337Z'
published: '2025-07-10'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:37:00.173Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38303'
references:
  - url: 'https://git.kernel.org/stable/c/2d4588f55cc10fc228f3b46469dbfb3f0a8b13c8'
  - url: 'https://git.kernel.org/stable/c/e98ce4b70beab73563d82bd21821024140e6da06'
  - url: 'https://git.kernel.org/stable/c/2af40d795d3fb0ee5c074b7ac56ab22402aa6e4f'
  - url: 'https://git.kernel.org/stable/c/b9db0c27e73b7c8a19384a44af527edfda74ff3d'
  - url: 'https://git.kernel.org/stable/c/47c03902269aff377f959dc3fd94a9733aa31d6e'
tags:
  - cve.org
epss: 0.00239
epssPercentile: 0.14844
ingestedAt: '2026-10-15T22:48:25.503Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: eir: Fix possible crashes on eir_create_adv_data

eir_create_adv_data may attempt to add EIR_FLAGS and EIR_TX_POWER
without checking if that would fit.

## Affected

- `Linux >= 01ce70b0a274bd76a5a311fb90d4d446d9bdfea1 < 2d4588f55cc10fc228f3b46469dbfb3f0a8b13c8`
- `Linux >= 01ce70b0a274bd76a5a311fb90d4d446d9bdfea1 < e98ce4b70beab73563d82bd21821024140e6da06`
- `Linux >= 01ce70b0a274bd76a5a311fb90d4d446d9bdfea1 < 2af40d795d3fb0ee5c074b7ac56ab22402aa6e4f`
- `Linux >= 01ce70b0a274bd76a5a311fb90d4d446d9bdfea1 < b9db0c27e73b7c8a19384a44af527edfda74ff3d`
- `Linux >= 01ce70b0a274bd76a5a311fb90d4d446d9bdfea1 < 47c03902269aff377f959dc3fd94a9733aa31d6e`
- `Linux 5.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.