GHSA-WQ7C-9CJ9-76JG

Vulnerability from github – Published: 2026-06-24 18:32 – Updated: 2026-06-24 18:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

When hci_register_dev() fails in hci_uart_register_dev() HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu) and setting hu->hdev to NULL. This means incoming UART data will reach the protocol-specific recv handler in hci_uart_tty_receive() after resources are freed.

Clear HCI_UART_PROTO_INIT with a write lock before calling hu->proto->close() and setting hu->hdev to NULL. The write lock ensures all active readers have completed and no new reader can enter the protocol recv path before resources are freed.

This allows the protocol-specific recv functions to remove the "HCI_UART_REGISTERED" guard without risking a null pointer dereference if hci_register_dev() fails.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-53073"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-24T17:17:21Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error\n\nWhen hci_register_dev() fails in hci_uart_register_dev()\nHCI_UART_PROTO_INIT is not cleared before calling hu-\u003eproto-\u003eclose(hu)\nand setting hu-\u003ehdev to NULL. This means incoming UART data will reach\nthe protocol-specific recv handler in hci_uart_tty_receive() after\nresources are freed.\n\nClear HCI_UART_PROTO_INIT with a write lock before calling\nhu-\u003eproto-\u003eclose() and setting hu-\u003ehdev to NULL. The write lock ensures\nall active readers have completed and no new reader can enter the\nprotocol recv path before resources are freed.\n\nThis allows the protocol-specific recv functions to remove the\n\"HCI_UART_REGISTERED\" guard without risking a null pointer dereference\nif hci_register_dev() fails.",
  "id": "GHSA-wq7c-9cj9-76jg",
  "modified": "2026-06-24T18:32:46Z",
  "published": "2026-06-24T18:32:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53073"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/194f029a4d7f739e44ebc1f473120187b4de5104"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/356dee1bcac4d0d9152390561fa63331ebff211b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3daa5818e473ed60eb69d8b5c71b651909d28c5a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/68d39ea5e0adc9ecaea1ce8abd842ec972eb8718"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ed4033fb85ccaaf6c3983be3c7b037e48253d232"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f4b69c35813c432973d340d3600c01de106ed474"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.