Medium 5.5Published Jun 24, 2026

CVE-2026-53073Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

Updated under an hour ago (Oct 28, 2026, 11:20 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error When hci_register_dev() fails in hci_uart_register_dev() HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu) and setting hu->hdev to NULL. This means incoming UART data will reach the protocol-specific recv handler in hci_uart_tty_receive() after resources are freed. Clear HCI_UART_PROTO_INIT with a write lock before calling hu->proto->close() and setting hu->hdev to NULL. The write lock ensures all active readers have completed and no new reader can enter the protocol recv path before resources are freed. This allows the protocol-specific recv functions to remove the "HCI_UART_REGISTERED" guard without risking a null pointer dereference if hci_register_dev() fails.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from a40f94f7caa8d3421b64f63ac31bc0f24c890f39 before ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07; from 9e5a0f5777162e503400c70c6ed25fbbe2d38799 before ed4033fb85ccaaf6c3983be3c7b037e48253d232; from 80f14e9de6a43a0bd8194cad1003a3e6dcbc3984 before 356dee1bcac4d0d9152390561fa63331ebff211b; from 02e1bcdfdf769974e7e9fa285e295cd9852e2a38 before a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40; from 281782d2c6730241e300d630bb9f200d831ede71 before f4b69c35813c432973d340d3600c01de106ed474; 5df5dafc171b90d0b8d51547a82657cd5a1986c7 builds before 3daa5818e473ed60eb69d8b5c71b651909d28c5a; from 5df5dafc171b90d0b8d51547a82657cd5a1986c7 before 194f029a4d7f739e44ebc1f473120187b4de5104; from 5df5dafc171b90d0b8d51547a82657cd5a1986c7 before 68d39ea5e0adc9ecaea1ce8abd842ec972eb8718; and 11 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 5.4.293 before 5.5; from 5.10.237 before 5.10.258; from 5.15.181 before 5.15.209; from 6.1.135 before 6.1.175; from 6.6.88 before 6.6.141; from 6.12.24 before 6.12.91; from 6.13.12 before 6.14; from 6.14.3 before 6.18.33; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07	patch
https://git.kernel.org/stable/c/ed4033fb85ccaaf6c3983be3c7b037e48253d232	patch
https://git.kernel.org/stable/c/356dee1bcac4d0d9152390561fa63331ebff211b	patch
https://git.kernel.org/stable/c/a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40	patch
https://git.kernel.org/stable/c/f4b69c35813c432973d340d3600c01de106ed474	patch
https://git.kernel.org/stable/c/3daa5818e473ed60eb69d8b5c71b651909d28c5a	patch
https://git.kernel.org/stable/c/194f029a4d7f739e44ebc1f473120187b4de5104	patch
https://git.kernel.org/stable/c/68d39ea5e0adc9ecaea1ce8abd842ec972eb8718	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.