{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21827", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.776Z", "datePublished": "2025-03-06T16:04:32.951Z", "dateUpdated": "2026-08-05T11:54:44.324Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:44.324Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()\n\nThe documentation for usb_driver_claim_interface() says that \"the\ndevice lock\" is needed when the function is called from places other\nthan probe(). This appears to be the lock for the USB interface\ndevice. The Mediatek btusb code gets called via this path:\n\n Workqueue: hci0 hci_power_on [bluetooth]\n Call trace:\n usb_driver_claim_interface\n btusb_mtk_claim_iso_intf\n btusb_mtk_setup\n hci_dev_open_sync\n hci_power_on\n process_scheduled_works\n worker_thread\n kthread\n\nWith the above call trace the device lock hasn't been claimed. Claim\nit.\n\nWithout this fix, we'd sometimes see the error \"Failed to claim iso\ninterface\". Sometimes we'd even see worse errors, like a NULL pointer\ndereference (where `intf->dev.driver` was NULL) with a trace like:\n\n Call trace:\n usb_suspend_both\n usb_runtime_suspend\n __rpm_callback\n rpm_suspend\n pm_runtime_work\n process_scheduled_works\n\nBoth errors appear to be fixed with the proper locking." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The racy claim runs in the local adapter bring-up path (`hci_power_on` → `hci_dev_open_sync` → `btusb_mtk_setup`) and races the local USB runtime-PM worker; no over-the-air Bluetooth frame or network packet reaches this code, and the unbind side is reached through local usbfs/sysfs interfaces.\nAC:L - The commit reports the failures occurring \"sometimes\" during ordinary bring-up with no special effort, and an attacker schedules both sides — each power cycle re-runs the unlocked claim (the ISO interface is released on every shutdown/disconnect) while the attacker independently drives idle/unbind via rfkill, replug, or usbfs disconnect, with unlimited free retries and no memory-layout or secret condition to guess.\nPR:L - An unprivileged local user can force repeated adapter re-initialization through rfkill unblock, a desktop-session Bluetooth power toggle, or USB replug without init-namespace CAP_NET_ADMIN, and can drive the unbind half of the race via a writable usbfs handle (`USBDEVFS_DISCONNECT`) routinely granted by plugdev/uaccess ACLs.\nUI:N - The attacker initiates the power cycle and the unbind entirely from their own process, and the claim path also executes automatically at boot and on probe; no separate victim action is required.\nS:U - The corrupted state is the kernel's own driver-core bind bookkeeping and USB PM state, all within the kernel's security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - The missing device lock lets `device_bind_driver()` race `device_release_driver()`/`device_del()`, leaving a `usb_interface` marked bound with stale `intfdata` on the driver's klist after teardown; per kernel scoring guidance this use-after-free class yields attacker-groomable stale-pointer reads through the PM and driver-core traversal paths.\nI:H - The same inconsistent bind state gives write reach — `klist_remove()` unlinking through a freed node, `btusb_suspend()` writing `data->suspend_count`/`data->flags`, and `gpiod_put(data->reset_gpio)`/`device_init_wakeup(&data->udev->dev)` on a reclaimed `btusb_data` — plus an indirect call through `driver->suspend` read from a corrupted pointer.\nA:H - The commit directly documents a kernel oops from dereferencing `to_usb_driver(NULL)->suspend` in the `pm_runtime_work` context, which kills the USB PM worker and the Bluetooth stack and becomes a full panic on the many embedded, automotive, and hardened deployments running `panic_on_oops`." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/bluetooth/btusb.c" ], "versions": [ { "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "lessThan": "930e1790b99e5839e1af69d2f7fd808f1fba2df9", "status": "affected", "versionType": "git" }, { "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "lessThan": "4194766ec8756f4f654d595ae49962acbac49490", "status": "affected", "versionType": "git" }, { "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "lessThan": "e9087e828827e5a5c85e124ce77503f2b81c3491", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/bluetooth/btusb.c" ], "versions": [ { "version": "6.11", "status": "affected" }, { "version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.13", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.13.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/930e1790b99e5839e1af69d2f7fd808f1fba2df9" }, { "url": "https://git.kernel.org/stable/c/4194766ec8756f4f654d595ae49962acbac49490" }, { "url": "https://git.kernel.org/stable/c/e9087e828827e5a5c85e124ce77503f2b81c3491" } ], "title": "Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()", "x_generator": { "engine": "bippy-1.2.0" } } } }