CVE-2026-53073: Linux Kernel Bluetooth HCI UART Denial of Service (Use-After-Free)

Technical summary

CVE-2026-53073 is a use-after-free vulnerability in the Linux kernel's HCI UART (Bluetooth) driver. During hci_uart_register_dev(), if hci_register_dev() fails, the HCI_UART_PROTO_INIT flag remains set while the driver cleans up resources by calling hu->proto->close() and nullifying hu->hdev. This race condition allows hci_uart_tty_receive() to invoke protocol-specific recv handlers after the underlying data structures have been freed. The fix involves clearing HCI_UART_PROTO_INIT under a write lock before resource cleanup, ensuring all active readers drain from the critical section before deallocation. The vulnerability is classified as CWE-476 (null pointer dereference / use-after-free).

Business impact

Organizations relying on Bluetooth connectivity in Linux-based systems face potential service disruption. An unprivileged local user with Bluetooth access could crash the kernel, triggering a denial of service. This is particularly relevant for embedded Linux systems, IoT devices, and Linux desktops with Bluetooth peripherals. The availability impact is direct and high, though the requirement for local access and specific Bluetooth UART interaction limits the attack surface in typical enterprise deployments. Recovery requires system reboot.

Affected systems

The Linux kernel across all versions prior to the fix is affected. The vulnerability specifically impacts systems using the HCI UART Bluetooth transport, which is common in embedded systems, single-board computers (Raspberry Pi, etc.), and some desktop/laptop configurations with Bluetooth UART adapters. Any system with a local user capable of interacting with a Bluetooth UART interface is at risk. Consult your Linux distribution's security advisories for patched kernel versions.

Exploitability

Exploitability requires local access (CVSS:3.1 AV:L) and appropriate privileges to interact with the Bluetooth UART subsystem. No network vector exists. An attacker must either be a local user with Bluetooth access or be able to send malformed UART data through an exposed Bluetooth interface. The technical complexity is low—sending crafted data to trigger the race condition is straightforward once the system conditions align. This is not listed on CISA's KEV catalog, suggesting active exploitation in the wild has not been formally documented at the time of publication, but the ease of triggering a kernel panic via local Bluetooth access should not be underestimated.

Remediation

Apply a kernel update that includes the fix for hci_ldisc.c which properly clears HCI_UART_PROTO_INIT under write lock protection before resource cleanup. Distributions typically backport this fix into stable kernel branches. Verify against your specific Linux distribution's security advisory for the exact patched kernel version. Interim mitigation: restrict local user access to Bluetooth UART interfaces or disable Bluetooth entirely if not required.

Patch guidance

Monitor your Linux distribution's kernel update channels (e.g., Ubuntu Security Updates, Red Hat Errata, SLES Security Updates) for advisory notifications. The fix is a small, low-risk change to the HCI UART driver's initialization error handling. Once available, apply kernel updates at your earliest maintenance window, as they typically require a reboot. Verify the patched kernel contains the write lock synchronization for HCI_UART_PROTO_INIT cleanup in hci_ldisc.c.

Detection guidance

Look for kernel panic logs or system crash reports on machines with active Bluetooth UART use, particularly those showing null pointer dereference or use-after-free messages in the HCI subsystem. Kernel ring buffer entries containing 'hci_uart' or 'proto->recv' followed by a crash are indicators. Passive detection is difficult; proactive patching is the recommended approach. Monitor for any anomalous restarts on Bluetooth-enabled Linux systems following user activity or Bluetooth peripheral connections.

Why prioritize this

Although this is a MEDIUM severity vulnerability (CVSS 5.5), it should be prioritized for systems actively using Bluetooth UART interfaces. The local-access requirement and unavailability on KEV catalog suggest it is not yet a widespread active threat, but kernel crashes are operationally disruptive and the fix is straightforward. Organizations operating embedded Linux or IoT systems with Bluetooth should treat this as higher priority than the raw score suggests.

Risk score, explained

CVSS 5.5 reflects local-only attack vector (AV:L), low complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), and high availability impact (A:H). The score appropriately downgrades severity due to the requirement for local access and Bluetooth-specific vector, but the direct denial-of-service outcome (kernel crash) justifies a MEDIUM rating. This is not a confidentiality or integrity issue, hence the absence of C and I impact.

Frequently asked questions