Bluetooth Interface Lock Vulnerability in Linux Package
Summary
DEBIAN-CVE-2025-21827: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface() The documentation for usb_driver_claim_interface() says that "the device lock" is... Affects linux versions < 6.12.13-1. Fixed in 6.12.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It includes drivers for various devices, including Bluetooth interfaces. This vulnerability specifically affects the Mediatek Bluetooth driver (btusb), which is responsible for handling Bluetooth communications. The issue arises from improper locking mechanisms when claiming USB interfaces, potentially leading to system instability and crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Bluetooth driver (btusb) related to the Mediatek chipset. The issue stems from the failure to acquire the necessary device lock when calling the usb_driver_claim_interface() function outside of the probe() context. This oversight can result in errors such as 'Failed to claim iso interface' and, in severe cases, a NULL pointer dereference, leading to system crashes. The vulnerability is rooted in the improper handling of USB interface locks, which are critical for ensuring safe access to device resources.
How To Fix
Minimum fixed version
6.12.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux package.
Conclusion
In summary, the Bluetooth interface lock vulnerability in the Linux package poses significant risks to system stability and security. Users are strongly advised to update their packages to the patched version 6.12.13-1 to mitigate these risks. Regular monitoring for vulnerabilities is essential to maintain system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper locking mechanisms in the Bluetooth driver for Mediatek devices, which can lead to system instability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Failure to address this vulnerability may result in system crashes, instability, and potential data loss due to NULL pointer dereferences.
Yes, the vulnerability affects the Linux package in both Debian 13 and Debian 14 prior to version 6.12.13-1.
It is recommended to regularly check for vulnerabilities, especially after updates or changes to your system. Using tools like Vulert can help automate this process.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
