CVE-2025-68298

CVE-2025-68298 involves a NULL dereference in Linux kernel Bluetooth code for Mediatek BTUSB. In btusb_mtk_setup(), btmtk_data->isopkt_intf can be NULL after usb_itf lookup (usb_ifnum_to_if). The code erroneously calls btusb_mtk_claim_iso_intf() even when isopkt_intf is NULL, leading to a cras...

CVE-2025-68298 Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Avoid btusbmtkclaimisointf NULL deref In btusbmtksetup, we set btmtkdata-isopktintf to: usbifnumtoifdata-udev, MTKISOIFNUM That function can return NULL in some cases. Even when it returns NULL, though...

CVE-2025-68298 Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Avoid btusbmtkclaimisointf NULL deref In btusbmtksetup, we set btmtkdata-isopktintf to: usbifnumtoifdata-udev, MTKISOIFNUM That function can return NULL in some cases. Even when it returns NULL, though...

Linux Distros Unpatched Vulnerability : CVE-2025-68306

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface When performing reset tests and encountering abnormal card drop issues that lead t...

PT-2025-51710

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the Bluetooth subsystem, specifically in the btusb mediatek component. A null pointer dereference can occur when releasing the MediaTek ISO...

Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel (Azure) vulnerabilities (USN-7935-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7935-1 advisory. Jean-Claude Graf, Sandro Regge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor...

Linux Distros Unpatched Vulnerability : CVE-2025-68305

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free t...

Linux Distros Unpatched Vulnerability : CVE-2025-68298

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btusb: mediatek: Avoid btusbmtkclaimisointf NULL deref In btusbmtksetup, we set btmtkdata-isopktintf to: usbifnumtoifdata-udev, MTKISOIFNUM That...

PT-2025-51708

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Bluetooth implementation within the Linux kernel, specifically in the hci core component. The issue relates to improper locking mechanisms when handling Bluetooth...

PT-2025-51702

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the Bluetooth subsystem, specifically in the btusb mediatek driver. A NULL dereference issue exists in the btusb mtk claim iso intf function. This...

Linux Distros Unpatched Vulnerability : CVE-2025-68304

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcicore: lookup hciconn on RX path on protocol side The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't ensure hciconn is not...

USN-7935-1: Linux kernel (Azure) vulnerabilities

Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this t...

CVE-2025-12035

An integer overflow condition exists in Bluetooth Host stack, within the btbraclrecv routine a critical path for processing inbound BR/EDR L2CAP traffic...

CVE-2025-12035

CVE-2025-12035 covers an integer overflow in the Bluetooth Host stack (bt_br_acl_recv) affecting BR/EDR L2CAP inbound processing in Zephyr’s Bluetooth implementation. The Red Hat/NVD/CVE listings describe the same issue; PT security entry notes affected Bluetooth host stack and the specific bt_br...

EUVD-2025-203444

An integer overflow condition exists in Bluetooth Host stack, within the btbraclrecv routine a critical path for processing inbound BR/EDR L2CAP traffic...

CVE-2025-12035 Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP

An integer overflow condition exists in Bluetooth Host stack, within the btbraclrecv routine a critical path for processing inbound BR/EDR L2CAP traffic...

CVE-2025-12035 Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP

An integer overflow condition exists in Bluetooth Host stack, within the btbraclrecv routine a critical path for processing inbound BR/EDR L2CAP traffic...

CVE-2025-12035 Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP

An integer overflow condition exists in Bluetooth Host stack, within the btbraclrecv routine a critical path for processing inbound BR/EDR L2CAP traffic...

RHEL 8 : kernel (RHSA-2025:17797)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17797 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: SVM: Don't BUG if...

PT-2025-51278

Name of the Vulnerable Software and Affected Versions Bluetooth affected versions not specified Description An integer overflow condition exists in the Bluetooth Host stack, specifically within the bt br acl recv routine. This routine is a critical path for processing inbound BR/EDR L2CAP traffic...