CVE-2025-68298: Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btusb: mediatek: Avoid btusbmtkclaimisointf() NULL deref
In btusbmtksetup(), we set btmtkdata->isopktintf to: usbifnumtoif(data->udev, MTKISOIFNUM)
That function can return NULL in some cases. Even when it returns NULL, though, we still go on to call btusbmtkclaimisointf().
As of commit e9087e828827 ("Bluetooth: btusb: mediatek: Add locks for usbdriverclaiminterface()"), calling btusbmtkclaimisointf() when btmtkdata->isopktintf is NULL will cause a crash because we'll end up passing a bad pointer to devicelock(). Prior to that commit we'd pass the NULL pointer directly to usbdriverclaiminterface() which would detect it and return an error, which was handled.
Resolve the crash in btusbmtkclaimisointf() by adding a NULL check at the start of the function. This makes the code handle a NULL btmtkdata->isopktintf the same way it did before the problematic commit (just with a slight change to the error message printed).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch e9087e828827
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68298?
CVE-2025-68298 has been classified as a medium severity vulnerability due to the potential for null dereference in the Bluetooth subsystem.
How do I fix CVE-2025-68298?
To fix CVE-2025-68298, update your Linux kernel to a version that includes the patch for this vulnerability.
What systems are affected by CVE-2025-68298?
CVE-2025-68298 affects the Linux kernel, specifically systems utilizing the Bluetooth subsystem with the Mediatek driver.
What are the potential impacts of CVE-2025-68298 if exploited?
If exploited, CVE-2025-68298 could lead to denial of service due to a null pointer dereference in the Bluetooth stack.
Is there a known exploit for CVE-2025-68298?
As of now, there are no publicly known exploits for CVE-2025-68298, but it is still important to apply patches to mitigate potential risks.