Linux Kernel CVE-2026-53073

The vulnerability lives in hci_ldisc.c, the HCI UART line discipline driver within the Linux kernel Bluetooth subsystem (CPE: cpe:2.3:a:linux:linux). When hci_uart_register_dev() calls hci_register_dev() and that registration fails, the code proceeds to invoke hu->proto->close(hu) and sets hu->hdev to NULL - but critically does not first clear the HCI_UART_PROTO_INIT flag. That flag guards the receive dispatch path in hci_uart_tty_receive(): as long as it remains set, incoming UART data continues to be routed to the protocol-specific recv handler even after hdev has been freed and nulled. CWE-476 (NULL Pointer Dereference) is the precise root cause: the recv handler subsequently dereferences the now-null hdev pointer, triggering a kernel panic. The fix, applied upstream, takes a write lock before the cleanup sequence, ensuring all active readers complete and no new reader can enter the recv path before both the flag is cleared and resources are released.