CVE-2025-37792
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btrtl: Prevent potential NULL dereference
The btrtl_initialize() function checks that rtl_load_file() either had an error or it loaded a zero length file. However, if it loaded a zero length file then the error code is not set correctly. It results in an error pointer vs NULL bug, followed by a NULL pointer dereference. This was detected by Smatch:
drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR'
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.20%
- Percentil entre todas las CVEs puntuadas: 9
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-476
Referencias
- https://git.kernel.org/stable/c/2d7c60c2a38b4b461fa960ad0995136a6bfe0756
- https://git.kernel.org/stable/c/324dddea321078a6eeb535c2bff5257be74c9799
- https://git.kernel.org/stable/c/3db6605043b50c8bb768547b23e0222f67ceef3e
- https://git.kernel.org/stable/c/53ceef799dcfc22c734d600811bfc9dd32eaea0a
- https://git.kernel.org/stable/c/73dc99c0ea94abd22379b2d82cacbc73f3e18ec1
- https://git.kernel.org/stable/c/aaf356f872a60db1e96fb762a62c4607fd22741f
- https://git.kernel.org/stable/c/c3e9717276affe59fd8213706db021b493e81e34
- https://git.kernel.org/stable/c/d8441818690d795232331bd8358545c5c95b6b72
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-37792",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "26503ad25de8c7c93a2037f919c2e49a62cf65f1",
"lessThan": "c3e9717276affe59fd8213706db021b493e81e34",
"versionType": "git"
},
{
"status": "affected",
"version": "26503ad25de8c7c93a2037f919c2e49a62cf65f1",
"lessThan": "73dc99c0ea94abd22379b2d82cacbc73f3e18ec1",
"versionType": "git"
},
{
"status": "affected",
"version": "26503ad25de8c7c93a2037f919c2e49a62cf65f1",
"lessThan": "2d7c60c2a38b4b461fa960ad0995136a6bfe0756",
"versionType": "git"
},
{
"status": "affected",
"version": "26503ad25de8c7c93a2037f919c2e49a62cf65f1",
"lessThan": "d8441818690d795232331bd8358545c5c95b6b72",
"versionType": "git"
},
{
"status": "affected",
"version": "26503ad25de8c7c93a2037f919c2e49a62cf65f1",
"lessThan": "3db6605043b50c8bb768547b23e0222f67ceef3e",
"versionType": "git"
},
{
"status": "affected",
"version": "26503ad25de8c7c93a2037f919c2e49a62cf65f1",
"lessThan": "aaf356f872a60db1e96fb762a62c4607fd22741f",
"versionType": "git"
},
{
"status": "affected",
"version": "26503ad25de8c7c93a2037f919c2e49a62cf65f1",
"lessThan": "53ceef799dcfc22c734d600811bfc9dd32eaea0a",
"versionType": "git"
},
{
"status": "affected",
"version": "26503ad25de8c7c93a2037f919c2e49a62cf65f1",
"lessThan": "324dddea321078a6eeb535c2bff5257be74c9799",
"versionType": "git"
}
],
"programFiles": [
"drivers/bluetooth/btrtl.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.19",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.4.293",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.237",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.181",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.135",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.88",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.25",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.14.4",
"versionType": "semver",
"lessThanOrEqual": "6.14.*"
},
{
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/bluetooth/btrtl.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-05-01T14:15:43.660",
"references": [
{
"url": "https://git.kernel.org/stable/c/2d7c60c2a38b4b461fa960ad0995136a6bfe0756",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/324dddea321078a6eeb535c2bff5257be74c9799",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3db6605043b50c8bb768547b23e0222f67ceef3e",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/53ceef799dcfc22c734d600811bfc9dd32eaea0a",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/73dc99c0ea94abd22379b2d82cacbc73f3e18ec1",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/aaf356f872a60db1e96fb762a62c4607fd22741f",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c3e9717276affe59fd8213706db021b493e81e34",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d8441818690d795232331bd8358545c5c95b6b72",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html",
"tags": [
"Mailing List"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html",
"tags": [
"Mailing List"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: Prevent potential NULL dereference\n\nThe btrtl_initialize() function checks that rtl_load_file() either\nhad an error or it loaded a zero length file. However, if it loaded\na zero length file then the error code is not set correctly. It\nresults in an error pointer vs NULL bug, followed by a NULL pointer\ndereference. This was detected by Smatch:\n\ndrivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR'"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: btrtl: Prevenir posible desreferencia de NULL. La función btrtl_initialize() comprueba si rtl_load_file() tuvo un error o cargó un archivo de longitud cero. Sin embargo, si cargó un archivo de longitud cero, el código de error no se configura correctamente. Esto genera un error de puntero de error vs. NULL, seguido de una desreferencia de puntero NULL. Esto fue detectado por Smatch: drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR'"
}
],
"lastModified": "2026-06-17T09:15:26.993",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "677CDA71-213E-46B8-A922-4245DC7F5C68",
"versionEndExcluding": "5.4.293",
"versionStartIncluding": "4.19"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0710B81E-E2FA-4E15-8F68-D297EBB4D50D",
"versionEndExcluding": "5.10.237",
"versionStartIncluding": "5.5"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "12331C9E-F601-4EFC-899E-369F98DCC70B",
"versionEndExcluding": "5.15.181",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5B9ACE29-7445-4B6F-B761-6367C005E275",
"versionEndExcluding": "6.1.135",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6E5947E5-45E3-462A-829B-382B3B1C61BD",
"versionEndExcluding": "6.6.88",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8E59EE65-FA6B-4AE4-8125-26135E28BF35",
"versionEndExcluding": "6.12.25",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "29FA1A8E-1C2A-4B0B-B397-2C915ECDEDEE",
"versionEndExcluding": "6.14.4",
"versionStartIncluding": "6.13"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}