Bug 2492447 (CVE-2026-53073)

Summary:	CVE-2026-53073 kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's Bluetooth Host Controller Interface (HCI) Universal Asynchronous Receiver/Transmitter (UART) driver. When the `hci_register_dev()` function fails, a flag indicating protocol initialization is not properly cleared. This oversight allows incoming UART data to be processed by the protocol-specific receive handler after its associated resources have been released, potentially leading to a null pointer dereference. This vulnerability could result in a system crash, causing a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-24 18:12:34 UTC

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

When hci_register_dev() fails in hci_uart_register_dev()
HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu)
and setting hu->hdev to NULL. This means incoming UART data will reach
the protocol-specific recv handler in hci_uart_tty_receive() after
resources are freed.

Clear HCI_UART_PROTO_INIT with a write lock before calling
hu->proto->close() and setting hu->hdev to NULL. The write lock ensures
all active readers have completed and no new reader can enter the
protocol recv path before resources are freed.

This allows the protocol-specific recv functions to remove the
"HCI_UART_REGISTERED" guard without risking a null pointer dereference
if hci_register_dev() fails.

Comment 1 Mauro Matteo Cascella 2026-06-25 09:02:12 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026062405-CVE-2026-53073-9692@gregkh/T

Comment 4 errata-xmlrpc 2026-09-04 00:52:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:63129 https://access.redhat.com/errata/RHSA-2026:63129

Comment 5 errata-xmlrpc 2026-09-04 01:02:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:63128 https://access.redhat.com/errata/RHSA-2026:63128