LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21827: Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface() The documentation for usb_driver_claim_interface() says that "the device lock" is needed when the function is called from places other than probe(). This appears to be the lock for the USB interface device. The Mediatek btusb code gets called via this path: Workqueue: hci0 hci_power_on [bluetooth] Call trace: usb_driver_claim_interface btusb_mtk_claim_iso_intf btusb_mtk_setup hci_dev_open_sync hci_power_on process_scheduled_works worker_thread kthread With the above call trace the device lock hasn't been claimed. Claim it. Without this fix, we'd sometimes see the error "Failed to claim iso interface". Sometimes we'd even see worse errors, like a NULL pointer dereference (where `intf->dev.driver` was NULL) with a trace like: Call trace: usb_suspend_both usb_runtime_suspend __rpm_callback rpm_suspend pm_runtime_work process_scheduled_works Both errors appear to be fixed with the proper locking.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-21827 is a Linux kernel Bluetooth driver issue affecting the MediaTek btusb path. Missing USB interface locking can cause Bluetooth interface claim failures and, in worse cases, a kernel NULL pointer dereference. The public bundle does not provide CVSS, KEV listing, or evidence of active exploitation.

Executive priority

Treat as a targeted platform reliability issue, not a broad internet-facing emergency based on current evidence. Patch through normal kernel maintenance, with faster handling for fleets using MediaTek Bluetooth hardware where workstation or device stability matters.

Technical view

The bug is in Linux Bluetooth btusb MediaTek handling around usb_driver_claim_interface() outside probe(). The code path can run during hci_power_on without holding the USB interface device lock. The kernel fix adds proper locking for btusb_mtk_claim_iso_intf to prevent failed ISO interface claims and related runtime suspend crashes.

Likely exposure

Exposure appears limited to Linux systems using the affected kernel Bluetooth stack with MediaTek USB Bluetooth hardware or equivalent btusb MediaTek code paths. The source bundle lists Linux kernel versions and stable commits but does not provide a clean product matrix or deployment prevalence.

Exploitation context

No active exploitation is stated in the supplied sources, and KEV is false. The described failures occur during Bluetooth power-on and USB runtime power-management paths. Evidence supports reliability and denial-of-service risk more than remote code execution, but impact is not formally scored.

Researcher notes

The supplied record lacks CVSS, CWE, and clear version-boundary details. Analysis should focus on the btusb MediaTek ISO interface claim path, locking around usb_driver_claim_interface(), and whether downstream distributions backported the referenced stable patches.

Mitigation direction

  • Review vendor or distribution kernel advisories for CVE-2025-21827.
  • Update to a kernel build containing one of the referenced stable fixes.
  • Prioritize systems with MediaTek USB Bluetooth adapters or enabled Bluetooth services.
  • If patching is delayed, assess whether Bluetooth can be disabled on exposed systems.

Validation and detection

  • Inventory Linux kernel versions and Bluetooth hardware models across managed systems.
  • Check whether deployed kernels include the referenced stable commits.
  • Review kernel logs for failed ISO interface claims or NULL pointer dereference traces.
  • Confirm vendor packages map CVE-2025-21827 to installed kernel builds.
Prepared
Confidence
medium
Sources
5

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21827 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxceac1cb0259de682d78f5c784ef8e0b13022e9d9, ceac1cb0259de682d78f5c784ef8e0b13022e9d9, ceac1cb0259de682d78f5c784ef8e0b13022e9d9unaffected
LinuxLinux6.11, 0, 6.12.13, 6.13.2, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.