CVE-2026-53073

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error<br /> <br /> When hci_register_dev() fails in hci_uart_register_dev()<br /> HCI_UART_PROTO_INIT is not cleared before calling hu-&gt;proto-&gt;close(hu)<br /> and setting hu-&gt;hdev to NULL. This means incoming UART data will reach<br /> the protocol-specific recv handler in hci_uart_tty_receive() after<br /> resources are freed.<br /> <br /> Clear HCI_UART_PROTO_INIT with a write lock before calling<br /> hu-&gt;proto-&gt;close() and setting hu-&gt;hdev to NULL. The write lock ensures<br /> all active readers have completed and no new reader can enter the<br /> protocol recv path before resources are freed.<br /> <br /> This allows the protocol-specific recv functions to remove the<br /> "HCI_UART_REGISTERED" guard without risking a null pointer dereference<br /> if hci_register_dev() fails.