CVE-2025-21827 (GCVE-0-2025-21827)

Vulnerability from cvelistv5 – Published: 2025-03-06 16:04 – Updated: 2026-08-05 11:54
VLAI
Title
Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface() The documentation for usb_driver_claim_interface() says that "the device lock" is needed when the function is called from places other than probe(). This appears to be the lock for the USB interface device. The Mediatek btusb code gets called via this path: Workqueue: hci0 hci_power_on [bluetooth] Call trace: usb_driver_claim_interface btusb_mtk_claim_iso_intf btusb_mtk_setup hci_dev_open_sync hci_power_on process_scheduled_works worker_thread kthread With the above call trace the device lock hasn't been claimed. Claim it. Without this fix, we'd sometimes see the error "Failed to claim iso interface". Sometimes we'd even see worse errors, like a NULL pointer dereference (where `intf->dev.driver` was NULL) with a trace like: Call trace: usb_suspend_both usb_runtime_suspend __rpm_callback rpm_suspend pm_runtime_work process_scheduled_works Both errors appear to be fixed with the proper locking.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ceac1cb0259de682d78f5c784ef8e0b13022e9d9 , < 930e1790b99e5839e1af69d2f7fd808f1fba2df9 (git)
Affected: ceac1cb0259de682d78f5c784ef8e0b13022e9d9 , < 4194766ec8756f4f654d595ae49962acbac49490 (git)
Affected: ceac1cb0259de682d78f5c784ef8e0b13022e9d9 , < e9087e828827e5a5c85e124ce77503f2b81c3491 (git)
Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.13 , ≤ 6.12.* (semver)
Unaffected: 6.13.2 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btusb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "930e1790b99e5839e1af69d2f7fd808f1fba2df9",
              "status": "affected",
              "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9",
              "versionType": "git"
            },
            {
              "lessThan": "4194766ec8756f4f654d595ae49962acbac49490",
              "status": "affected",
              "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9",
              "versionType": "git"
            },
            {
              "lessThan": "e9087e828827e5a5c85e124ce77503f2b81c3491",
              "status": "affected",
              "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btusb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.13",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()\n\nThe documentation for usb_driver_claim_interface() says that \"the\ndevice lock\" is needed when the function is called from places other\nthan probe(). This appears to be the lock for the USB interface\ndevice. The Mediatek btusb code gets called via this path:\n\n  Workqueue: hci0 hci_power_on [bluetooth]\n  Call trace:\n   usb_driver_claim_interface\n   btusb_mtk_claim_iso_intf\n   btusb_mtk_setup\n   hci_dev_open_sync\n   hci_power_on\n   process_scheduled_works\n   worker_thread\n   kthread\n\nWith the above call trace the device lock hasn\u0027t been claimed. Claim\nit.\n\nWithout this fix, we\u0027d sometimes see the error \"Failed to claim iso\ninterface\". Sometimes we\u0027d even see worse errors, like a NULL pointer\ndereference (where `intf-\u003edev.driver` was NULL) with a trace like:\n\n  Call trace:\n   usb_suspend_both\n   usb_runtime_suspend\n   __rpm_callback\n   rpm_suspend\n   pm_runtime_work\n   process_scheduled_works\n\nBoth errors appear to be fixed with the proper locking."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The racy claim runs in the local adapter bring-up path (`hci_power_on` \u2192 `hci_dev_open_sync` \u2192 `btusb_mtk_setup`) and races the local USB runtime-PM worker; no over-the-air Bluetooth frame or network packet reaches this code, and the unbind side is reached through local usbfs/sysfs interfaces.\nAC:L - The commit reports the failures occurring \"sometimes\" during ordinary bring-up with no special effort, and an attacker schedules both sides \u2014 each power cycle re-runs the unlocked claim (the ISO interface is released on every shutdown/disconnect) while the attacker independently drives idle/unbind via rfkill, replug, or usbfs disconnect, with unlimited free retries and no memory-layout or secret condition to guess.\nPR:L - An unprivileged local user can force repeated adapter re-initialization through rfkill unblock, a desktop-session Bluetooth power toggle, or USB replug without init-namespace CAP_NET_ADMIN, and can drive the unbind half of the race via a writable usbfs handle (`USBDEVFS_DISCONNECT`) routinely granted by plugdev/uaccess ACLs.\nUI:N - The attacker initiates the power cycle and the unbind entirely from their own process, and the claim path also executes automatically at boot and on probe; no separate victim action is required.\nS:U - The corrupted state is the kernel\u0027s own driver-core bind bookkeeping and USB PM state, all within the kernel\u0027s security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - The missing device lock lets `device_bind_driver()` race `device_release_driver()`/`device_del()`, leaving a `usb_interface` marked bound with stale `intfdata` on the driver\u0027s klist after teardown; per kernel scoring guidance this use-after-free class yields attacker-groomable stale-pointer reads through the PM and driver-core traversal paths.\nI:H - The same inconsistent bind state gives write reach \u2014 `klist_remove()` unlinking through a freed node, `btusb_suspend()` writing `data-\u003esuspend_count`/`data-\u003eflags`, and `gpiod_put(data-\u003ereset_gpio)`/`device_init_wakeup(\u0026data-\u003eudev-\u003edev)` on a reclaimed `btusb_data` \u2014 plus an indirect call through `driver-\u003esuspend` read from a corrupted pointer.\nA:H - The commit directly documents a kernel oops from dereferencing `to_usb_driver(NULL)-\u003esuspend` in the `pm_runtime_work` context, which kills the USB PM worker and the Bluetooth stack and becomes a full panic on the many embedded, automotive, and hardened deployments running `panic_on_oops`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:44.324Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/930e1790b99e5839e1af69d2f7fd808f1fba2df9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4194766ec8756f4f654d595ae49962acbac49490"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9087e828827e5a5c85e124ce77503f2b81c3491"
        }
      ],
      "title": "Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21827",
    "datePublished": "2025-03-06T16:04:32.951Z",
    "dateReserved": "2024-12-29T08:45:45.776Z",
    "dateUpdated": "2026-08-05T11:54:44.324Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21827",
      "date": "2026-08-14",
      "epss": "0.00145",
      "percentile": "0.04221"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21827\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-06T16:15:54.967\",\"lastModified\":\"2026-07-30T06:21:39.637\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()\\n\\nThe documentation for usb_driver_claim_interface() says that \\\"the\\ndevice lock\\\" is needed when the function is called from places other\\nthan probe(). This appears to be the lock for the USB interface\\ndevice. The Mediatek btusb code gets called via this path:\\n\\n  Workqueue: hci0 hci_power_on [bluetooth]\\n  Call trace:\\n   usb_driver_claim_interface\\n   btusb_mtk_claim_iso_intf\\n   btusb_mtk_setup\\n   hci_dev_open_sync\\n   hci_power_on\\n   process_scheduled_works\\n   worker_thread\\n   kthread\\n\\nWith the above call trace the device lock hasn\u0027t been claimed. Claim\\nit.\\n\\nWithout this fix, we\u0027d sometimes see the error \\\"Failed to claim iso\\ninterface\\\". Sometimes we\u0027d even see worse errors, like a NULL pointer\\ndereference (where `intf-\u003edev.driver` was NULL) with a trace like:\\n\\n  Call trace:\\n   usb_suspend_both\\n   usb_runtime_suspend\\n   __rpm_callback\\n   rpm_suspend\\n   pm_runtime_work\\n   process_scheduled_works\\n\\nBoth errors appear to be fixed with the proper locking.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface() The documentation for usb_driver_claim_interface() says that \\\"the device lock\\\" is needed when the function is called from places other than probe(). This appears to be the lock for the USB interface device. The Mediatek btusb code gets called via this path: Workqueue: hci0 hci_power_on [bluetooth] Call trace: usb_driver_claim_interface btusb_mtk_claim_iso_intf btusb_mtk_setup hci_dev_open_sync hci_power_on process_scheduled_works worker_thread kthread With the above call trace the device lock hasn\u0027t been claimed. Claim it. Without this fix, we\u0027d sometimes see the error \\\"Failed to claim iso interface\\\". Sometimes we\u0027d even see worse errors, like a NULL pointer dereference (where `intf-\u0026gt;dev.driver` was NULL) with a trace like: Call trace: usb_suspend_both usb_runtime_suspend __rpm_callback rpm_suspend pm_runtime_work process_scheduled_works Ambos errores parecen solucionarse con el bloqueo adecuado.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/bluetooth/btusb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ceac1cb0259de682d78f5c784ef8e0b13022e9d9\",\"lessThan\":\"930e1790b99e5839e1af69d2f7fd808f1fba2df9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ceac1cb0259de682d78f5c784ef8e0b13022e9d9\",\"lessThan\":\"4194766ec8756f4f654d595ae49962acbac49490\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ceac1cb0259de682d78f5c784ef8e0b13022e9d9\",\"lessThan\":\"e9087e828827e5a5c85e124ce77503f2b81c3491\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/bluetooth/btusb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.13\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.2\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.12.13\",\"matchCriteriaId\":\"2C65B261-0C55-4563-835E-FD44483D02B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.2\",\"matchCriteriaId\":\"6D4116B1-1BFD-4F23-BA84-169CC05FC5A3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4194766ec8756f4f654d595ae49962acbac49490\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/930e1790b99e5839e1af69d2f7fd808f1fba2df9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e9087e828827e5a5c85e124ce77503f2b81c3491\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:13:20+00:00",
      "cve": "CVE-2025-21827",
      "id": "CVE-2025-21827",
      "initial_release_date": "2025-03-06T00:00:00+00:00",
      "product_status:known_affected": "226",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21827.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:19:32Z",
      "cve": "CVE-2025-21827",
      "id": "CVE-2025-21827",
      "initial_release_date": "2025-03-07T02:37:10Z",
      "product_status:known_not_affected": "352",
      "product_status:recommended": "112",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21827",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21827.json",
      "version": "17"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.