Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.11 % · percentile 1 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error When hci_register_dev() fails in hci_uart_register_dev() HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu) and setting hu->hdev to NULL. This means incoming UART data will reach the protocol-specific recv handler in hci_uart_tty_receive() after resources are freed. Clear HCI_UART_PROTO_INIT with a write lock before calling hu->proto->close() and setting hu->hdev to NULL. The write lock ensures all active readers have completed and no new reader can enter the protocol recv path before resources are freed. This allows the protocol-specific recv functions to remove the "HCI_UART_REGISTERED" guard without risking a null pointer dereference if hci_register_dev() fails.
Weaknesses (CWE)
- CWE-476 — NULL Pointer Dereference
References
- https://git.kernel.org/stable/c/ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07
- https://git.kernel.org/stable/c/ed4033fb85ccaaf6c3983be3c7b037e48253d232
- https://git.kernel.org/stable/c/356dee1bcac4d0d9152390561fa63331ebff211b
- https://git.kernel.org/stable/c/a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40
- https://git.kernel.org/stable/c/f4b69c35813c432973d340d3600c01de106ed474
- https://git.kernel.org/stable/c/3daa5818e473ed60eb69d8b5c71b651909d28c5a
- https://git.kernel.org/stable/c/194f029a4d7f739e44ebc1f473120187b4de5104
- https://git.kernel.org/stable/c/68d39ea5e0adc9ecaea1ce8abd842ec972eb8718
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-38941
- GCVE · GCVE-0-2026-53073
CERT-FR advisories
- CERTFR-2026-AVI-1431 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1252 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1162 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1093 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1066 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1064 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0985 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0927 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0866 — Multiples vulnérabilités dans Microsoft Azure Linux · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0862 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.293 < 5.5cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.237 < 5.10.258cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.181 < 5.15.209cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1.135 < 6.1.175cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6.88 < 6.6.141cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.12.24 < 6.12.91cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13.12 < 6.14cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.14.3 < 6.18.33cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 7.0.10
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected a40f94f7caa8d3421b64f63ac31bc0f24c890f39 < ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07 ; affected 9e5a0f5777162e503400c70c6ed25fbbe2d38799 < ed4033fb85ccaaf6c3983be3c7b037e48253d232 ; affected 80f14e9de6a43a0bd8194cad1003a3e6dcbc3984 < 356dee1bcac4d0d9152390561fa63331ebff211b ; affected 02e1bcdfdf769974e7e9fa285e295cd9852e2a38 < a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40 ; affected 281782d2c6730241e300d630bb9f200d831ede71 < f4b69c35813c432973d340d3600c01de106ed474 ; affected 5df5dafc171b90d0b8d51547a82657cd5a1986c7 < 3daa5818e473ed60eb69d8b5c71b651909d28c5a |
| Linux · Linux | affected 6.15 ; unaffected 0 < 6.15 ; unaffected 5.10.258 ≤ 5.10.* ; unaffected 5.15.209 ≤ 5.15.* ; unaffected 6.1.175 ≤ 6.1.* ; unaffected 6.6.141 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |