CVE-2026-53073: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53073 Overview

CVE-2026-53073 is a race condition in the Linux kernel Bluetooth HCI UART line discipline (hci_ldisc). When hci_register_dev() fails inside hci_uart_register_dev(), the HCI_UART_PROTO_INIT flag is not cleared before the code invokes hu->proto->close(hu) and sets hu->hdev to NULL. Incoming UART data can reach the protocol-specific receive handler in hci_uart_tty_receive() after the underlying resources have already been freed. The defect creates a window for a use-after-free and potential null pointer dereference in kernel space.

Critical Impact
Concurrent UART receive paths can dereference freed protocol resources, leading to kernel memory corruption or denial of service on affected Linux systems with Bluetooth UART transports.

Affected Products

Linux kernel (Bluetooth subsystem, drivers/bluetooth/hci_ldisc.c)
Distributions shipping vulnerable kernel versions prior to the upstream fix
Systems using HCI UART transports for Bluetooth (commonly embedded and mobile Linux devices)

Discovery Timeline

2026-06-24 - CVE-2026-53073 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53073

Vulnerability Analysis

The defect lives in the HCI UART line discipline that bridges serial transports to the Linux Bluetooth core. During registration, hci_uart_register_dev() sets the HCI_UART_PROTO_INIT flag to mark the protocol as initialized. If the subsequent call to hci_register_dev() fails, the cleanup path calls hu->proto->close(hu) and clears hu->hdev, but it does not clear HCI_UART_PROTO_INIT first. Readers in hci_uart_tty_receive() consult this flag to decide whether to dispatch into the protocol-specific recv callback. Because the flag still appears set, a concurrent UART receive can enter the protocol handler after close() has released its resources, producing a use-after-free or null dereference on hu->hdev.

Root Cause

The root cause is missing synchronization between the failure cleanup path and active line-discipline readers. The cleanup path tears down protocol state without first invalidating the state predicate that readers rely on. Without a write lock around clearing HCI_UART_PROTO_INIT, in-flight readers can hold a stale view of an initialized protocol while its memory is being released.

Attack Vector

Exploitation requires the ability to trigger HCI UART registration failure while UART data is being delivered to the line discipline. Local actors with access to attach line disciplines or control a Bluetooth UART transport can race the failure path against incoming bytes. The result is kernel-side memory unsafety in the Bluetooth receive path rather than direct remote exploitation. The upstream fix clears HCI_UART_PROTO_INIT under a write lock before calling hu->proto->close(), ensuring all active readers drain and no new reader can enter the protocol receive path before resources are freed.

No public proof-of-concept code has been published for this issue. See the upstream patches for technical details, including Linux Kernel Commit 194f029 and Linux Kernel Commit f4b69c3.

Detection Methods for CVE-2026-53073

Indicators of Compromise

Kernel oops or panic messages referencing hci_uart_tty_receive, hci_uart_register_dev, or null pointer dereferences in drivers/bluetooth/hci_ldisc.c.
KASAN use-after-free reports involving the hci_uart structure or its proto member on systems with KASAN enabled.
Unexpected Bluetooth subsystem resets or HCI device registration failures logged in dmesg.

Detection Strategies

Audit running kernel versions against the fixed commits listed in the upstream stable tree to identify hosts still exposed.
Enable CONFIG_KASAN on test or canary systems that exercise Bluetooth UART devices to surface the use-after-free deterministically.
Correlate TIOCSETD ioctl activity binding N_HCI line disciplines with subsequent kernel faults to spot abusive sequences.

Monitoring Recommendations

Forward kern.crit and kern.err syslog facilities to a central log store and alert on Bluetooth driver stack traces.
Track unexpected reboots and kernel crash dumps on endpoints with Bluetooth UART hardware, particularly embedded and IoT-class Linux systems.
Monitor for unprivileged processes invoking line discipline changes on serial devices, which is uncommon in production workloads.

How to Mitigate CVE-2026-53073

Immediate Actions Required

Inventory Linux hosts that load the hci_uart module and prioritize those using Bluetooth over serial transports.
Apply the upstream kernel update containing the hci_ldisc fix or the backport provided by your distribution.
Restrict local user access on systems where Bluetooth UART transports cannot be disabled, since exploitation requires local interaction with the transport.

Patch Information

The upstream fix clears HCI_UART_PROTO_INIT under a write lock before calling hu->proto->close() and setting hu->hdev to NULL. Apply the kernel build that includes the relevant stable commits, including Linux Kernel Commit 356dee1, Linux Kernel Commit 3daa581, Linux Kernel Commit 68d39ea, Linux Kernel Commit a673cf6, Linux Kernel Commit ebb39b2, and Linux Kernel Commit ed4033f.

Workarounds

Blacklist the hci_uart module on systems that do not require Bluetooth UART transports until patches are deployed.
Disable Bluetooth entirely on endpoints where the feature is not used, removing the affected code path.
Limit physical and local account access to devices that expose serial Bluetooth transports, reducing the attacker pool able to trigger the race.

bash

# Configuration example
# Prevent hci_uart from loading until the kernel is patched
echo 'blacklist hci_uart' | sudo tee /etc/modprobe.d/blacklist-hci_uart.conf
sudo modprobe -r hci_uart 2>/dev/null || true
sudo update-initramfs -u