Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem that could lead to a system crash. When a Bluetooth device fails to initialize properly, the system may attempt to process incoming data using memory that has already been cleared. This could result in a 'null pointer dereference,' causing the operating system to stop responding or restart unexpectedly.
Technical details
A race condition exists in `drivers/bluetooth/hci_ldisc.c` within the Linux kernel. When `hci_register_dev()` fails inside `hci_uart_register_dev()`, the `HCI_UART_PROTO_INIT` flag is not cleared before the protocol is closed and the device structure is set to NULL. This allows incoming UART data to reach the protocol-specific receive handler (`hci_uart_tty_receive`) after resources have been freed, leading to a null pointer dereference. The fix involves clearing the initialization flag using a write lock to ensure all active readers have completed before resources are released. This issue affects multiple stable kernel branches and has been patched in versions including 5.10.218, 5.15.160, 6.1.92, 6.6.32, and 6.8.11.
Affected products
- Linux Linux Kernel 5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.8.y, 6.9.y
Timeline
- 2026-03-27: other: Vulnerability fixed in upstream code
- 2026-06-24: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/194f029a4d7f739e44ebc1f473120187b4de5104
- https://git.kernel.org/stable/c/356dee1bcac4d0d9152390561fa63331ebff211b
- https://git.kernel.org/stable/c/3daa5818e473ed60eb69d8b5c71b651909d28c5a
- https://git.kernel.org/stable/c/68d39ea5e0adc9ecaea1ce8abd842ec972eb8718
- https://git.kernel.org/stable/c/a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40
- https://git.kernel.org/stable/c/ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07
- https://git.kernel.org/stable/c/ed4033fb85ccaaf6c3983be3c7b037e48253d232