CVE-2025-22102 is a vulnerability in the Linux kernel affecting the Bluetooth driver module btnxpuart. The flaw arises during the firmware release process when WLAN and Bluetooth firmware downloads occur simultaneously. Due to a hardware bug in the affected chip, only a single bootloader signature is sent instead of multiple consecutive signatures expected by the driver. When the driver receives this single bootloader signature, it enters firmware download mode but does not request the firmware file because no consecutive signatures follow. After a 60-second timeout waiting for the firmware download, the release_firmware function triggers a kernel panic, causing a denial of service. The kernel panic is evidenced by an internal error (Oops) related to a kernel paging request at an invalid virtual address, indicating a null pointer or invalid memory dereference during the release_firmware call. This vulnerability is specific to certain hardware platforms such as the NXP i.MX8MPlus EVK board and affects Linux kernel versions identified by the given commit hashes. The issue is triggered under stress test scenarios involving simultaneous WLAN and Bluetooth firmware downloads, exploiting a hardware limitation in bootloader signature transmission. While no remote code execution or privilege escalation is indicated, the kernel panic results in system instability and potential downtime. No CVSS score is assigned yet, and no known exploits in the wild have been reported as of the publication date April 16, 2025.

For European organizations, this vulnerability poses a risk primarily to embedded systems, IoT devices, and industrial equipment running affected Linux kernel versions on hardware platforms using the btnxpuart Bluetooth driver, such as NXP i.MX8MPlus-based devices. The kernel panic leads to system crashes and denial of service, which can disrupt critical operations in sectors relying on embedded Linux systems, including manufacturing, telecommunications, automotive, and healthcare. Systems performing simultaneous WLAN and Bluetooth firmware updates are particularly vulnerable, potentially causing unexpected downtime during maintenance or normal operation. While the vulnerability does not appear to allow code execution or data compromise, the loss of availability can impact service continuity, safety systems, and operational technology environments. European organizations with supply chains or products incorporating affected hardware and Linux kernel versions must consider the risk of operational disruption and plan for timely patching. The lack of known exploits reduces immediate threat but does not eliminate risk, especially in environments where firmware updates are frequent or automated.

1. Apply the official Linux kernel patches that address this issue as soon as they become available from trusted sources or Linux distributions. 2. Identify and inventory all devices running affected Linux kernel versions with the btnxpuart Bluetooth driver, especially those using NXP i.MX8MPlus or similar hardware. 3. Implement controlled firmware update procedures to avoid simultaneous WLAN and Bluetooth firmware downloads where possible, reducing the chance of triggering the bug. 4. Monitor system logs for kernel panics or Oops messages related to release_firmware or btnxpuart to detect potential triggering of the vulnerability. 5. For embedded and IoT devices, coordinate with hardware vendors and device manufacturers to obtain updated firmware or kernel versions that incorporate the fix. 6. Where patching is not immediately feasible, consider disabling Bluetooth functionality or the btnxpuart driver if Bluetooth is not critical, to mitigate risk. 7. Establish robust backup and recovery procedures to minimize downtime impact in case of kernel panics. 8. Engage with device and hardware vendors to confirm if their products are affected and request guidance or updates.