CVE-2025-21827

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21827", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.776Z", "datePublished": "2025-03-06T16:04:32.951Z", "dateUpdated": "2026-10-15T21:51:53.571Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:44.324Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()\n\nThe documentation for usb_driver_claim_interface() says that \"the\ndevice lock\" is needed when the function is called from places other\nthan probe(). This appears to be the lock for the USB interface\ndevice. The Mediatek btusb code gets called via this path:\n\n Workqueue: hci0 hci_power_on [bluetooth]\n Call trace:\n usb_driver_claim_interface\n btusb_mtk_claim_iso_intf\n btusb_mtk_setup\n hci_dev_open_sync\n hci_power_on\n process_scheduled_works\n worker_thread\n kthread\n\nWith the above call trace the device lock hasn't been claimed. Claim\nit.\n\nWithout this fix, we'd sometimes see the error \"Failed to claim iso\ninterface\". Sometimes we'd even see worse errors, like a NULL pointer\ndereference (where `intf->dev.driver` was NULL) with a trace like:\n\n Call trace:\n usb_suspend_both\n usb_runtime_suspend\n __rpm_callback\n rpm_suspend\n pm_runtime_work\n process_scheduled_works\n\nBoth errors appear to be fixed with the proper locking."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The racy claim runs in the local adapter bring-up path (`hci_power_on` \u2192 `hci_dev_open_sync` \u2192 `btusb_mtk_setup`) and races the local USB runtime-PM worker; no over-the-air Bluetooth frame or network packet reaches this code, and the unbind side is reached through local usbfs/sysfs interfaces.\nAC:L - The commit reports the failures occurring \"sometimes\" during ordinary bring-up with no special effort, and an attacker schedules both sides \u2014 each power cycle re-runs the unlocked claim (the ISO interface is released on every shutdown/disconnect) while the attacker independently drives idle/unbind via rfkill, replug, or usbfs disconnect, with unlimited free retries and no memory-layout or secret condition to guess.\nPR:L - An unprivileged local user can force repeated adapter re-initialization through rfkill unblock, a desktop-session Bluetooth power toggle, or USB replug without init-namespace CAP_NET_ADMIN, and can drive the unbind half of the race via a writable usbfs handle (`USBDEVFS_DISCONNECT`) routinely granted by plugdev/uaccess ACLs.\nUI:N - The attacker initiates the power cycle and the unbind entirely from their own process, and the claim path also executes automatically at boot and on probe; no separate victim action is required.\nS:U - The corrupted state is the kernel's own driver-core bind bookkeeping and USB PM state, all within the kernel's security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - The missing device lock lets `device_bind_driver()` race `device_release_driver()`/`device_del()`, leaving a `usb_interface` marked bound with stale `intfdata` on the driver's klist after teardown; per kernel scoring guidance this use-after-free class yields attacker-groomable stale-pointer reads through the PM and driver-core traversal paths.\nI:H - The same inconsistent bind state gives write reach \u2014 `klist_remove()` unlinking through a freed node, `btusb_suspend()` writing `data->suspend_count`/`data->flags`, and `gpiod_put(data->reset_gpio)`/`device_init_wakeup(&data->udev->dev)` on a reclaimed `btusb_data` \u2014 plus an indirect call through `driver->suspend` read from a corrupted pointer.\nA:H - The commit directly documents a kernel oops from dereferencing `to_usb_driver(NULL)->suspend` in the `pm_runtime_work` context, which kills the USB PM worker and the Bluetooth stack and becomes a full panic on the many embedded, automotive, and hardened deployments running `panic_on_oops`."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btusb.c"], "versions": [{"version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "lessThan": "930e1790b99e5839e1af69d2f7fd808f1fba2df9", "status": "affected", "versionType": "git"}, {"version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "lessThan": "4194766ec8756f4f654d595ae49962acbac49490", "status": "affected", "versionType": "git"}, {"version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "lessThan": "e9087e828827e5a5c85e124ce77503f2b81c3491", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btusb.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.13", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.13.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/930e1790b99e5839e1af69d2f7fd808f1fba2df9"}, {"url": "https://git.kernel.org/stable/c/4194766ec8756f4f654d595ae49962acbac49490"}, {"url": "https://git.kernel.org/stable/c/e9087e828827e5a5c85e124ce77503f2b81c3491"}], "title": "Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21827", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:43:07.629582Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:53.571Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21827", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:43:07.629582Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:43:08.109Z"}}], "cna": {"title": "Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The racy claim runs in the local adapter bring-up path (`hci_power_on` \u2192 `hci_dev_open_sync` \u2192 `btusb_mtk_setup`) and races the local USB runtime-PM worker; no over-the-air Bluetooth frame or network packet reaches this code, and the unbind side is reached through local usbfs/sysfs interfaces.\nAC:L - The commit reports the failures occurring \"sometimes\" during ordinary bring-up with no special effort, and an attacker schedules both sides \u2014 each power cycle re-runs the unlocked claim (the ISO interface is released on every shutdown/disconnect) while the attacker independently drives idle/unbind via rfkill, replug, or usbfs disconnect, with unlimited free retries and no memory-layout or secret condition to guess.\nPR:L - An unprivileged local user can force repeated adapter re-initialization through rfkill unblock, a desktop-session Bluetooth power toggle, or USB replug without init-namespace CAP_NET_ADMIN, and can drive the unbind half of the race via a writable usbfs handle (`USBDEVFS_DISCONNECT`) routinely granted by plugdev/uaccess ACLs.\nUI:N - The attacker initiates the power cycle and the unbind entirely from their own process, and the claim path also executes automatically at boot and on probe; no separate victim action is required.\nS:U - The corrupted state is the kernel's own driver-core bind bookkeeping and USB PM state, all within the kernel's security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - The missing device lock lets `device_bind_driver()` race `device_release_driver()`/`device_del()`, leaving a `usb_interface` marked bound with stale `intfdata` on the driver's klist after teardown; per kernel scoring guidance this use-after-free class yields attacker-groomable stale-pointer reads through the PM and driver-core traversal paths.\nI:H - The same inconsistent bind state gives write reach \u2014 `klist_remove()` unlinking through a freed node, `btusb_suspend()` writing `data->suspend_count`/`data->flags`, and `gpiod_put(data->reset_gpio)`/`device_init_wakeup(&data->udev->dev)` on a reclaimed `btusb_data` \u2014 plus an indirect call through `driver->suspend` read from a corrupted pointer.\nA:H - The commit directly documents a kernel oops from dereferencing `to_usb_driver(NULL)->suspend` in the `pm_runtime_work` context, which kills the USB PM worker and the Bluetooth stack and becomes a full panic on the many embedded, automotive, and hardened deployments running `panic_on_oops`."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "lessThan": "930e1790b99e5839e1af69d2f7fd808f1fba2df9", "versionType": "git"}, {"status": "affected", "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "lessThan": "4194766ec8756f4f654d595ae49962acbac49490", "versionType": "git"}, {"status": "affected", "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "lessThan": "e9087e828827e5a5c85e124ce77503f2b81c3491", "versionType": "git"}], "programFiles": ["drivers/bluetooth/btusb.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"status": "unaffected", "version": "0", "lessThan": "6.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.13", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.2", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/bluetooth/btusb.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/930e1790b99e5839e1af69d2f7fd808f1fba2df9"}, {"url": "https://git.kernel.org/stable/c/4194766ec8756f4f654d595ae49962acbac49490"}, {"url": "https://git.kernel.org/stable/c/e9087e828827e5a5c85e124ce77503f2b81c3491"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()\n\nThe documentation for usb_driver_claim_interface() says that \"the\ndevice lock\" is needed when the function is called from places other\nthan probe(). This appears to be the lock for the USB interface\ndevice. The Mediatek btusb code gets called via this path:\n\n Workqueue: hci0 hci_power_on [bluetooth]\n Call trace:\n usb_driver_claim_interface\n btusb_mtk_claim_iso_intf\n btusb_mtk_setup\n hci_dev_open_sync\n hci_power_on\n process_scheduled_works\n worker_thread\n kthread\n\nWith the above call trace the device lock hasn't been claimed. Claim\nit.\n\nWithout this fix, we'd sometimes see the error \"Failed to claim iso\ninterface\". Sometimes we'd even see worse errors, like a NULL pointer\ndereference (where `intf->dev.driver` was NULL) with a trace like:\n\n Call trace:\n usb_suspend_both\n usb_runtime_suspend\n __rpm_callback\n rpm_suspend\n pm_runtime_work\n process_scheduled_works\n\nBoth errors appear to be fixed with the proper locking."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.13", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.2", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14", "versionStartIncluding": "6.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:44.324Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21827", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:51:53.571Z", "dateReserved": "2024-12-29T08:45:45.776Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-03-06T16:04:32.951Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/bluetooth/btusb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "930e1790b99e5839e1af69d2f7fd808f1fba2df9", "status": "affected", "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "versionType": "git"}, {"lessThan": "4194766ec8756f4f654d595ae49962acbac49490", "status": "affected", "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "versionType": "git"}, {"lessThan": "e9087e828827e5a5c85e124ce77503f2b81c3491", "status": "affected", "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/bluetooth/btusb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.13", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2C65B261-0C55-4563-835E-FD44483D02B3", "versionEndExcluding": "6.12.13", "versionStartIncluding": "6.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D4116B1-1BFD-4F23-BA84-169CC05FC5A3", "versionEndExcluding": "6.13.2", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()\n\nThe documentation for usb_driver_claim_interface() says that \"the\ndevice lock\" is needed when the function is called from places other\nthan probe(). This appears to be the lock for the USB interface\ndevice. The Mediatek btusb code gets called via this path:\n\n Workqueue: hci0 hci_power_on [bluetooth]\n Call trace:\n usb_driver_claim_interface\n btusb_mtk_claim_iso_intf\n btusb_mtk_setup\n hci_dev_open_sync\n hci_power_on\n process_scheduled_works\n worker_thread\n kthread\n\nWith the above call trace the device lock hasn't been claimed. Claim\nit.\n\nWithout this fix, we'd sometimes see the error \"Failed to claim iso\ninterface\". Sometimes we'd even see worse errors, like a NULL pointer\ndereference (where `intf->dev.driver` was NULL) with a trace like:\n\n Call trace:\n usb_suspend_both\n usb_runtime_suspend\n __rpm_callback\n rpm_suspend\n pm_runtime_work\n process_scheduled_works\n\nBoth errors appear to be fixed with the proper locking."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface() The documentation for usb_driver_claim_interface() says that \"the device lock\" is needed when the function is called from places other than probe(). This appears to be the lock for the USB interface device. The Mediatek btusb code gets called via this path: Workqueue: hci0 hci_power_on [bluetooth] Call trace: usb_driver_claim_interface btusb_mtk_claim_iso_intf btusb_mtk_setup hci_dev_open_sync hci_power_on process_scheduled_works worker_thread kthread With the above call trace the device lock hasn't been claimed. Claim it. Without this fix, we'd sometimes see the error \"Failed to claim iso interface\". Sometimes we'd even see worse errors, like a NULL pointer dereference (where `intf->dev.driver` was NULL) with a trace like: Call trace: usb_suspend_both usb_runtime_suspend __rpm_callback rpm_suspend pm_runtime_work process_scheduled_works Ambos errores parecen solucionarse con el bloqueo adecuado."}], "id": "CVE-2025-21827", "lastModified": "2026-10-15T22:18:09.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21827", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:43:07.629582Z", "version": "2.0.3"}}]}, "published": "2025-03-06T16:15:54.967", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4194766ec8756f4f654d595ae49962acbac49490"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/930e1790b99e5839e1af69d2f7fd808f1fba2df9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e9087e828827e5a5c85e124ce77503f2b81c3491"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()", "id": "2350395", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2350395"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()\nThe documentation for usb_driver_claim_interface() says that \"the\ndevice lock\" is needed when the function is called from places other\nthan probe(). This appears to be the lock for the USB interface\ndevice. The Mediatek btusb code gets called via this path:\nWorkqueue: hci0 hci_power_on [bluetooth]\nCall trace:\nusb_driver_claim_interface\nbtusb_mtk_claim_iso_intf\nbtusb_mtk_setup\nhci_dev_open_sync\nhci_power_on\nprocess_scheduled_works\nworker_thread\nkthread\nWith the above call trace the device lock hasn't been claimed. Claim\nit.\nWithout this fix, we'd sometimes see the error \"Failed to claim iso\ninterface\". Sometimes we'd even see worse errors, like a NULL pointer\ndereference (where `intf->dev.driver` was NULL) with a trace like:\nCall trace:\nusb_suspend_both\nusb_runtime_suspend\n__rpm_callback\nrpm_suspend\npm_runtime_work\nprocess_scheduled_works\nBoth errors appear to be fixed with the proper locking."], "name": "CVE-2025-21827", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-03-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21827\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21827\nhttps://lore.kernel.org/linux-cve-announce/2025030630-CVE-2025-21827-6735@gregkh/T"], "threat_severity": "Low"}

{}