CVE-2026-53073
Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error When hci_register_dev() fails in hci_uart_register_dev() HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu) and setting hu->hdev to NULL. This means incoming UART data will reach the protocol-specific recv handler in hci_uart_tty_receive() after resources are freed. Clear HCI_UART_PROTO_INIT with a write lock before calling hu->proto->close() and setting hu->hdev to NULL. The write lock ensures all active readers have completed and no new reader can enter the protocol recv path before resources are freed. This allows the protocol-specific recv functions to remove the "HCI_UART_REGISTERED" guard without risking a null pointer dereference if hci_register_dev() fails.
INFO
Published Date :
June 24, 2026, 5:17 p.m.
Last Modified :
July 21, 2026, 6:05 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Apply the provided Linux kernel patch.
- Ensure the patch correctly clears HCI_UART_PROTO_INIT.
- Verify the write lock protects resource freeing.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53073.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53073 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53073
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53073 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53073 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 21, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-476 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13.12 up to (excluding) 6.14 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.4.293 up to (excluding) 5.5 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.237 up to (excluding) 5.10.258 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.181 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.135 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.12.24 up to (excluding) 6.12.91 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.14.3 up to (excluding) 6.18.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.6.88 up to (excluding) 6.6.141 Added Reference Type kernel.org: https://git.kernel.org/stable/c/194f029a4d7f739e44ebc1f473120187b4de5104 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/356dee1bcac4d0d9152390561fa63331ebff211b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/3daa5818e473ed60eb69d8b5c71b651909d28c5a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/68d39ea5e0adc9ecaea1ce8abd842ec972eb8718 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ed4033fb85ccaaf6c3983be3c7b037e48253d232 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/f4b69c35813c432973d340d3600c01de106ed474 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'a40f94f7caa8d3421b64f63ac31bc0f24c890f39', 'lessThan': 'ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07', 'versionType': 'git'}, {'status': 'affected', 'version': '9e5a0f5777162e503400c70c6ed25fbbe2d38799', 'lessThan': 'ed4033fb85ccaaf6c3983be3c7b037e48253d232', 'versionType': 'git'}, {'status': 'affected', 'version': '80f14e9de6a43a0bd8194cad1003a3e6dcbc3984', 'lessThan': '356dee1bcac4d0d9152390561fa63331ebff211b', 'versionType': 'git'}, {'status': 'affected', 'version': '02e1bcdfdf769974e7e9fa285e295cd9852e2a38', 'lessThan': 'a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40', 'versionType': 'git'}, {'status': 'affected', 'version': '281782d2c6730241e300d630bb9f200d831ede71', 'lessThan': 'f4b69c35813c432973d340d3600c01de106ed474', 'versionType': 'git'}, {'status': 'affected', 'version': '5df5dafc171b90d0b8d51547a82657cd5a1986c7', 'lessThan': '3daa5818e473ed60eb69d8b5c71b651909d28c5a', 'versionType': 'git'}, {'status': 'affected', 'version': '5df5dafc171b90d0b8d51547a82657cd5a1986c7', 'lessThan': '194f029a4d7f739e44ebc1f473120187b4de5104', 'versionType': 'git'}, {'status': 'affected', 'version': '5df5dafc171b90d0b8d51547a82657cd5a1986c7', 'lessThan': '68d39ea5e0adc9ecaea1ce8abd842ec972eb8718', 'versionType': 'git'}, {'status': 'affected', 'version': '1dcf08fcff5ca529de6dc0395091f28854f4e54a', 'versionType': 'git'}, {'status': 'affected', 'version': '8e5aff600539e5faea294d9612cca50220e602b8', 'versionType': 'git'}, {'status': 'affected', 'version': 'db7509fa110dd9b11134b75894677f30353b2c51', 'versionType': 'git'}, {'status': 'affected', 'version': '5.10.237', 'lessThan': '5.10.258', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.15.181', 'lessThan': '5.15.209', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.135', 'lessThan': '6.1.175', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.6.88', 'lessThan': '6.6.141', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.12.24', 'lessThan': '6.12.91', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.4.293', 'lessThan': '5.5', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.13.12', 'lessThan': '6.14', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.14.3', 'lessThan': '6.15', 'versionType': 'semver'}], 'programFiles': ['drivers/bluetooth/hci_ldisc.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.141', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.91', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/bluetooth/hci_ldisc.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error When hci_register_dev() fails in hci_uart_register_dev() HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu) and setting hu->hdev to NULL. This means incoming UART data will reach the protocol-specific recv handler in hci_uart_tty_receive() after resources are freed. Clear HCI_UART_PROTO_INIT with a write lock before calling hu->proto->close() and setting hu->hdev to NULL. The write lock ensures all active readers have completed and no new reader can enter the protocol recv path before resources are freed. This allows the protocol-specific recv functions to remove the "HCI_UART_REGISTERED" guard without risking a null pointer dereference if hci_register_dev() fails. Added Reference https://git.kernel.org/stable/c/194f029a4d7f739e44ebc1f473120187b4de5104 Added Reference https://git.kernel.org/stable/c/356dee1bcac4d0d9152390561fa63331ebff211b Added Reference https://git.kernel.org/stable/c/3daa5818e473ed60eb69d8b5c71b651909d28c5a Added Reference https://git.kernel.org/stable/c/68d39ea5e0adc9ecaea1ce8abd842ec972eb8718 Added Reference https://git.kernel.org/stable/c/a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40 Added Reference https://git.kernel.org/stable/c/ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07 Added Reference https://git.kernel.org/stable/c/ed4033fb85ccaaf6c3983be3c7b037e48253d232 Added Reference https://git.kernel.org/stable/c/f4b69c35813c432973d340d3600c01de106ed474