---
id: CVE-2025-38315
title: 'Bluetooth: btintel: Check dsbr size from EFI variable'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: btintel: Check dsbr size from EFI variable

  Since the size of struct btintel_dsbr is already known, we can just
  start there instead of querying the EFI varia…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= eb9e749c0182affafadfbe5ded4503c4b5a9b57c <
    9427f6081f37c795a8bd29d0ee72a4da3bd64af8
  - >-
    Linux >= eb9e749c0182affafadfbe5ded4503c4b5a9b57c <
    7b8526bb489780ccc0caffc446ecabec83cfe568
  - >-
    Linux >= eb9e749c0182affafadfbe5ded4503c4b5a9b57c <
    3aa1dc3c9060e335e82e9c182bf3d1db29220b1b
  - Linux 6.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:54:20.513213Z'
published: '2025-07-10'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:02:32.587Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38315'
references:
  - url: 'https://git.kernel.org/stable/c/9427f6081f37c795a8bd29d0ee72a4da3bd64af8'
  - url: 'https://git.kernel.org/stable/c/7b8526bb489780ccc0caffc446ecabec83cfe568'
  - url: 'https://git.kernel.org/stable/c/3aa1dc3c9060e335e82e9c182bf3d1db29220b1b'
tags:
  - cve.org
epss: 0.00164
epssPercentile: 0.05617
ingestedAt: '2026-11-05T22:38:31.952Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: Check dsbr size from EFI variable

Since the size of struct btintel_dsbr is already known, we can just
start there instead of querying the EFI variable size. If the final
result doesn't match what we expect also fail. This fixes a stack buffer
overflow when the EFI variable is larger than struct btintel_dsbr.

## Affected

- `Linux >= eb9e749c0182affafadfbe5ded4503c4b5a9b57c < 9427f6081f37c795a8bd29d0ee72a4da3bd64af8`
- `Linux >= eb9e749c0182affafadfbe5ded4503c4b5a9b57c < 7b8526bb489780ccc0caffc446ecabec83cfe568`
- `Linux >= eb9e749c0182affafadfbe5ded4503c4b5a9b57c < 3aa1dc3c9060e335e82e9c182bf3d1db29220b1b`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.