Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-53073

Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, and 3 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error When hci_register_dev() fails in hci_uart_register_dev() HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu) and setting hu->hdev to NULL. This means incoming UART data will reach the protocol-specific recv handler in hci_uart_tty_receive() after resources are freed. Clear HCI_UART_PROTO_INIT with a write lock before calling hu->proto->close() and setting hu->hdev to NULL. The write lock ensures all active readers have completed and no new reader can enter the protocol recv path before resources are freed. This allows the protocol-specific recv functions to remove the "HCI_UART_REGISTERED" guard without risking a null pointer dereference if hci_register_dev() fails.

Timeline

  1. CVE published

Affected versions

  • Linux Linux

    From 5.10.237 · fixed in 5.10.258; From 5.15.181 · fixed in 5.15.209; From 6.1.135 · fixed in 6.1.175; From 6.6.88 · fixed in 6.6.141; From 6.12.24 · fixed in 6.12.91; From 5.4.293 · fixed in 5.5; From 6.13.12 · fixed in 6.14; From 6.14.3 · fixed in 6.15

  • Linux Linux

    6.15

References 8

git.kernel.org