CVE-2025-21827

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()

The documentation for usb_driver_claim_interface() says that "the

device lock" is needed when the function is called from places other

than probe(). This appears to be the lock for the USB interface

device. The Mediatek btusb code gets called via this path:

Workqueue: hci0 hci_power_on [bluetooth]

Call trace:

usb_driver_claim_interface

btusb_mtk_claim_iso_intf

btusb_mtk_setup

hci_dev_open_sync

hci_power_on

process_scheduled_works

worker_thread

kthread

With the above call trace the device lock hasn't been claimed. Claim

it.

Without this fix, we'd sometimes see the error "Failed to claim iso

interface". Sometimes we'd even see worse errors, like a NULL pointer

dereference (where `intf->dev.driver` was NULL) with a trace like:

Call trace:

usb_suspend_both

usb_runtime_suspend

__rpm_callback

rpm_suspend

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References