CVE-2026-53073

Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

State: Published
Severity: Not scored
Published: Jun 24, 2026
Updated: Jun 24, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

When hci_register_dev() fails in hci_uart_register_dev() HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu) and setting hu->hdev to NULL. This means incoming UART data will reach the protocol-specific recv handler in hci_uart_tty_receive() after resources are freed.

Clear HCI_UART_PROTO_INIT with a write lock before calling hu->proto->close() and setting hu->hdev to NULL. The write lock ensures all active readers have completed and no new reader can enter the protocol recv path before resources are freed.

This allows the protocol-specific recv functions to remove the "HCI_UART_REGISTERED" guard without risking a null pointer dereference if hci_register_dev() fails.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a40f94f7caa8d3421b64f63ac31bc0f24c890f39 to before ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07Affected 9e5a0f5777162e503400c70c6ed25fbbe2d38799 to before ed4033fb85ccaaf6c3983be3c7b037e48253d232Affected 80f14e9de6a43a0bd8194cad1003a3e6dcbc3984 to before 356dee1bcac4d0d9152390561fa63331ebff211bAffected 02e1bcdfdf769974e7e9fa285e295cd9852e2a38 to before a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40Affected 281782d2c6730241e300d630bb9f200d831ede71 to before f4b69c35813c432973d340d3600c01de106ed474Affected 5df5dafc171b90d0b8d51547a82657cd5a1986c7 to before 3daa5818e473ed60eb69d8b5c71b651909d28c5aAffected 5df5dafc171b90d0b8d51547a82657cd5a1986c7 to before 194f029a4d7f739e44ebc1f473120187b4de5104Affected 5df5dafc171b90d0b8d51547a82657cd5a1986c7 to before 68d39ea5e0adc9ecaea1ce8abd842ec972eb8718Affected 1dcf08fcff5ca529de6dc0395091f28854f4e54aAffected 8e5aff600539e5faea294d9612cca50220e602b8Affected db7509fa110dd9b11134b75894677f30353b2c51Affected 5.10.237 to before 5.10.258Affected 5.15.181 to before 5.15.209Affected 6.1.135 to before 6.1.175Affected 6.6.88 to before 6.6.141Affected 6.12.24 to before 6.12.91Affected 5.4.293 to before 5.5Affected 6.13.12 to before 6.14Affected 6.14.3 to before 6.15Affected
LinuxLinux	6.15Affected before 6.15Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

a40f94f7caa8d3421b64f63ac31bc0f24c890f39 to before ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07Affected
9e5a0f5777162e503400c70c6ed25fbbe2d38799 to before ed4033fb85ccaaf6c3983be3c7b037e48253d232Affected
80f14e9de6a43a0bd8194cad1003a3e6dcbc3984 to before 356dee1bcac4d0d9152390561fa63331ebff211bAffected
02e1bcdfdf769974e7e9fa285e295cd9852e2a38 to before a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40Affected
281782d2c6730241e300d630bb9f200d831ede71 to before f4b69c35813c432973d340d3600c01de106ed474Affected
5df5dafc171b90d0b8d51547a82657cd5a1986c7 to before 3daa5818e473ed60eb69d8b5c71b651909d28c5aAffected
5df5dafc171b90d0b8d51547a82657cd5a1986c7 to before 194f029a4d7f739e44ebc1f473120187b4de5104Affected
5df5dafc171b90d0b8d51547a82657cd5a1986c7 to before 68d39ea5e0adc9ecaea1ce8abd842ec972eb8718Affected
1dcf08fcff5ca529de6dc0395091f28854f4e54aAffected
8e5aff600539e5faea294d9612cca50220e602b8Affected
db7509fa110dd9b11134b75894677f30353b2c51Affected
5.10.237 to before 5.10.258Affected
5.15.181 to before 5.15.209Affected
6.1.135 to before 6.1.175Affected
6.6.88 to before 6.6.141Affected
6.12.24 to before 6.12.91Affected
5.4.293 to before 5.5Affected
6.13.12 to before 6.14Affected
6.14.3 to before 6.15Affected

LinuxLinux

6.15Affected
before 6.15Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.