CVE-2025-68306: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68306 is a null pointer dereference vulnerability in the Linux kernel's Bluetooth btusb driver for MediaTek devices, specifically in the btusb_mtk_release_iso_intf function. The flaw occurs when releasing the MediaTek ISO interface during reset operations or abnormal device disconnection (card drop) scenarios, where a null pointer dereference triggers a kernel panic. It was disclosed on December 16, 2025, and affects Linux kernel versions prior to the fix commits. It carries a CVSS v3.1 base score of 5.5 (Medium), with a local attack vector and high availability impact (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing null pointer check (CWE-476) in the btusb_mtk_release_iso_intf function within the Linux kernel's btusb driver for MediaTek Bluetooth USB devices. During a Bluetooth reset (btusb_mtk_reset) or abnormal card removal, the function attempts to call usb_driver_release_interface on a potentially null interface pointer, leading to a kernel panic via klist_remove. The crash trace shows the fault occurring at klist_remove+0x90/0x158, called through device_release_driver_internal → usb_driver_release_interface → btusb_mtk_release_iso_intf. The fix adds a null check before attempting to release the interface resource (Red Hat Bugzilla).

Successful exploitation causes a kernel panic and complete system crash (denial of service), as evidenced by the Kernel panic - not syncing: Oops: Fatal exception message in the crash trace. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Systems using MediaTek Bluetooth USB adapters (e.g., devices running on Google Quigon boards or similar ARM-based platforms with MediaTek BT chipsets) are at risk of unexpected reboots or service interruption when Bluetooth reset or abnormal disconnection events occur (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability requires local access with low privileges to trigger (e.g., initiating a Bluetooth reset or causing an abnormal device disconnection). The EPSS score is 0.017% (0.000170), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory).

The fix is included in patched Linux kernel versions via upstream stable commits (e.g., 421e88a0d857, 4015b9797671, faae9f2ea880). Downstream distributions have issued advisories: Ubuntu has released USN-8094-1 through USN-8094-5 and USN-8152-1, and Oracle has released ELSA-2026-50112. Users should update to the latest patched kernel version for their distribution. As a temporary workaround, disabling Bluetooth services (systemctl disable bluetooth) on affected systems with MediaTek USB Bluetooth adapters can prevent the crash from occurring (Red Hat Advisory, Ubuntu USN-8094-1).