PT-2026-51967 · Linux · Linux

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-53073

NVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci ldisc: Clear HCI UART PROTO INIT on error

When hci register dev() fails in hci uart register dev() HCI UART PROTO INIT is not cleared before calling hu->proto->close(hu) and setting hu->hdev to NULL. This means incoming UART data will reach the protocol-specific recv handler in hci uart tty receive() after resources are freed.

Clear HCI UART PROTO INIT with a write lock before calling hu->proto->close() and setting hu->hdev to NULL. The write lock ensures all active readers have completed and no new reader can enter the protocol recv path before resources are freed.

This allows the protocol-specific recv functions to remove the "HCI UART REGISTERED" guard without risking a null pointer dereference if hci register dev() fails.

Related Identifiers

CVE-2026-53073

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-53073 · Security Note
• https://git.kernel.org/stable/c/f4b69c35813c432973d340d3600c01de106ed474 · Note
• https://git.kernel.org/stable/c/ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07 · Note
• https://git.kernel.org/stable/c/ed4033fb85ccaaf6c3983be3c7b037e48253d232 · Note
• https://git.kernel.org/stable/c/68d39ea5e0adc9ecaea1ce8abd842ec972eb8718 · Note
• https://git.kernel.org/stable/c/a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40 · Note
• https://git.kernel.org/stable/c/356dee1bcac4d0d9152390561fa63331ebff211b · Note
• https://git.kernel.org/stable/c/194f029a4d7f739e44ebc1f473120187b4de5104 · Note
• https://git.kernel.org/stable/c/3daa5818e473ed60eb69d8b5c71b651909d28c5a · Note