---
id: CVE-2025-21827
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()

  The documentation for usb_driver_claim_interface() says that "the
  device lock" is needed when th…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()

  The documentation for usb_driver_claim_interface() says that "the
  device lock" is needed when th…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-667
  - CWE-413
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.11, < 6.12.13'
  - 'linux_kernel >= 6.13, < 6.13.2'
patched:
  - linux_kernel 6.13.2
published: '2025-03-06'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:09.443'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-21827'
references:
  - url: 'https://git.kernel.org/stable/c/4194766ec8756f4f654d595ae49962acbac49490'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/930e1790b99e5839e1af69d2f7fd808f1fba2df9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e9087e828827e5a5c85e124ce77503f2b81c3491'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21827.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-21827'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2350395'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-21827'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-21827'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2025030630-CVE-2025-21827-6735@gregkh/T
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00149
epssPercentile: 0.04016
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:43:07.629582Z'
scores:
  nvd: 7.8
  vendor: 5.5
ingestedAt: '2026-07-30T06:53:10.274Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()

The documentation for usb_driver_claim_interface() says that "the
device lock" is needed when the function is called from places other
than probe(). This appears to be the lock for the USB interface
device. The Mediatek btusb code gets called via this path:

  Workqueue: hci0 hci_power_on [bluetooth]
  Call trace:
   usb_driver_claim_interface
   btusb_mtk_claim_iso_intf
   btusb_mtk_setup
   hci_dev_open_sync
   hci_power_on
   process_scheduled_works
   worker_thread
   kthread

With the above call trace the device lock hasn't been claimed. Claim
it.

Without this fix, we'd sometimes see the error "Failed to claim iso
interface". Sometimes we'd even see worse errors, like a NULL pointer
dereference (where `intf->dev.driver` was NULL) with a trace like:

  Call trace:
   usb_suspend_both
   usb_runtime_suspend
   __rpm_callback
   rpm_suspend
   pm_runtime_work
   process_scheduled_works

Both errors appear to be fixed with the proper locking.

## Affected

- `linux_kernel >= 6.11, < 6.12.13`
- `linux_kernel >= 6.13, < 6.13.2`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.13.2`

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21827.json)