CVE-2025-68298: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68298 is a NULL pointer dereference vulnerability in the Linux kernel's Bluetooth MediaTek USB driver (btusb). It was disclosed on December 16, 2025, and affects Linux kernel versions introduced after commit e9087e828827 ("Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()") up to the patched releases. The flaw exists in btusb_mtk_setup(), where usb_ifnum_to_if() can return NULL but the code proceeds to call btusb_mtk_claim_iso_intf(), ultimately passing a bad pointer to device_lock() and causing a kernel crash. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in the btusb_mtk_claim_iso_intf() function of the Linux kernel's MediaTek Bluetooth USB driver. In btusb_mtk_setup(), the field btmtk_data->isopkt_intf is assigned the return value of usb_ifnum_to_if(data->udev, MTK_ISO_IFNUM), which can legitimately return NULL if the USB interface is not found. Prior to commit e9087e828827, this NULL was passed directly to usb_driver_claim_interface(), which handled it gracefully; after that commit added locking, the NULL is instead passed to device_lock(), triggering a kernel crash. The fix adds a NULL check at the start of btusb_mtk_claim_iso_intf() to restore the previous safe behavior (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation causes a kernel crash, resulting in a denial of service (system becomes unresponsive or requires reboot). The vulnerability affects only systems with MediaTek Bluetooth USB hardware and a vulnerable kernel version. There is no impact on confidentiality or integrity — only availability is affected (Red Hat CVE).

Update the Linux kernel to a patched version: 6.12.61 or later for the 6.12 stable branch, 6.17.11 or later for the 6.17 branch, or 6.18 and above. Ubuntu has issued security notices USN-8094-1 through USN-8094-5 and USN-8152-1 addressing this vulnerability. Oracle Linux has also released a patched kernel (ELSA-2026-50112). As a workaround, restricting physical and local access to affected systems reduces exposure until a patch can be applied (Red Hat CVE, Ubuntu USN-8094-1, Ubuntu USN-8152-1).