CVE-2025-21827: Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()
The documentation for usb_driver_claim_interface() says that "the
device lock" is needed when the function is called from places other
than probe(). This appears to be the lock for the USB interface
device. The Mediatek btusb code gets called via this path:
Workqueue: hci0 hci_power_on [bluetooth]
Call trace:
usb_driver_claim_interface
btusb_mtk_claim_iso_intf
btusb_mtk_setup
hci_dev_open_sync
hci_power_on
process_scheduled_works
worker_thread
kthread
With the above call trace the device lock hasn't been claimed. Claim
it.
Without this fix, we'd sometimes see the error "Failed to claim iso
interface". Sometimes we'd even see worse errors, like a NULL pointer
dereference (where `intf->dev.driver` was NULL) with a trace like:
Call trace:
usb_suspend_both
usb_runtime_suspend
__rpm_callback
rpm_suspend
pm_runtime_work
process_scheduled_works
Both errors appear to be fixed with the proper locking.
Security readout for executives and security teams
Plain-English summary
CVE-2025-21827 is a Linux kernel Bluetooth driver issue affecting the MediaTek btusb path. Missing USB interface locking can cause Bluetooth interface claim failures and, in worse cases, a kernel NULL pointer dereference. The public bundle does not provide CVSS, KEV listing, or evidence of active exploitation.
Executive priority
Treat as a targeted platform reliability issue, not a broad internet-facing emergency based on current evidence. Patch through normal kernel maintenance, with faster handling for fleets using MediaTek Bluetooth hardware where workstation or device stability matters.
Technical view
The bug is in Linux Bluetooth btusb MediaTek handling around usb_driver_claim_interface() outside probe(). The code path can run during hci_power_on without holding the USB interface device lock. The kernel fix adds proper locking for btusb_mtk_claim_iso_intf to prevent failed ISO interface claims and related runtime suspend crashes.
Likely exposure
Exposure appears limited to Linux systems using the affected kernel Bluetooth stack with MediaTek USB Bluetooth hardware or equivalent btusb MediaTek code paths. The source bundle lists Linux kernel versions and stable commits but does not provide a clean product matrix or deployment prevalence.
Exploitation context
No active exploitation is stated in the supplied sources, and KEV is false. The described failures occur during Bluetooth power-on and USB runtime power-management paths. Evidence supports reliability and denial-of-service risk more than remote code execution, but impact is not formally scored.
Researcher notes
The supplied record lacks CVSS, CWE, and clear version-boundary details. Analysis should focus on the btusb MediaTek ISO interface claim path, locking around usb_driver_claim_interface(), and whether downstream distributions backported the referenced stable patches.
Mitigation direction
Review vendor or distribution kernel advisories for CVE-2025-21827.
Update to a kernel build containing one of the referenced stable fixes.
Prioritize systems with MediaTek USB Bluetooth adapters or enabled Bluetooth services.
If patching is delayed, assess whether Bluetooth can be disabled on exposed systems.
Validation and detection
Inventory Linux kernel versions and Bluetooth hardware models across managed systems.
Check whether deployed kernels include the referenced stable commits.
Review kernel logs for failed ISO interface claims or NULL pointer dereference traces.
Confirm vendor packages map CVE-2025-21827 to installed kernel builds.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-21827 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
4Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Mar 6, 2025, 16:04 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.