---
id: CVE-2025-38304
title: 'Bluetooth: Fix NULL pointer deference on eir_get_service_data'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: Fix NULL pointer deference on eir_get_service_data

  The len parameter is considered optional so it can be NULL so it cannot
  be used for skipping to next entr…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8f9ae5b3ae80f168a6224529e3787f4fb27f299a <
    497c9d2d7d3983826bb02c10fb4a5818be6550fb
  - >-
    Linux >= 8f9ae5b3ae80f168a6224529e3787f4fb27f299a <
    4bf29910570666e668a60d953f8da78e95bb7fa2
  - >-
    Linux >= 8f9ae5b3ae80f168a6224529e3787f4fb27f299a <
    842f7c3154d5b25ca11753c02ee8cf6ee64c0142
  - >-
    Linux >= 8f9ae5b3ae80f168a6224529e3787f4fb27f299a <
    7d99cc0f8e6fa0f35570887899f178122a61d44e
  - >-
    Linux >= 8f9ae5b3ae80f168a6224529e3787f4fb27f299a <
    20a2aa01f5aeb6daad9aeaa7c33dd512c58d81eb
  - Linux 5.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:53:29.101894Z'
published: '2025-07-10'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:02:31.417Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38304'
references:
  - url: 'https://git.kernel.org/stable/c/497c9d2d7d3983826bb02c10fb4a5818be6550fb'
  - url: 'https://git.kernel.org/stable/c/4bf29910570666e668a60d953f8da78e95bb7fa2'
  - url: 'https://git.kernel.org/stable/c/842f7c3154d5b25ca11753c02ee8cf6ee64c0142'
  - url: 'https://git.kernel.org/stable/c/7d99cc0f8e6fa0f35570887899f178122a61d44e'
  - url: 'https://git.kernel.org/stable/c/20a2aa01f5aeb6daad9aeaa7c33dd512c58d81eb'
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.0719
ingestedAt: '2026-11-05T22:38:31.949Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix NULL pointer deference on eir_get_service_data

The len parameter is considered optional so it can be NULL so it cannot
be used for skipping to next entry of EIR_SERVICE_DATA.

## Affected

- `Linux >= 8f9ae5b3ae80f168a6224529e3787f4fb27f299a < 497c9d2d7d3983826bb02c10fb4a5818be6550fb`
- `Linux >= 8f9ae5b3ae80f168a6224529e3787f4fb27f299a < 4bf29910570666e668a60d953f8da78e95bb7fa2`
- `Linux >= 8f9ae5b3ae80f168a6224529e3787f4fb27f299a < 842f7c3154d5b25ca11753c02ee8cf6ee64c0142`
- `Linux >= 8f9ae5b3ae80f168a6224529e3787f4fb27f299a < 7d99cc0f8e6fa0f35570887899f178122a61d44e`
- `Linux >= 8f9ae5b3ae80f168a6224529e3787f4fb27f299a < 20a2aa01f5aeb6daad9aeaa7c33dd512c58d81eb`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.