In the Linux kernel, when Bluetooth HCI UART registration fails, the protocol initialization flag is not cleared before the protocol‑specific close routine executes. This leaves the UART receive handler with a stale protocol reference, causing incoming data to be processed after the associated resources have been freed and the device reference nulled. The result is a null‑pointer dereference which can crash the kernel and potentially lead to denial of service. The bug does not expose arbitrary code execution but it can terminate processes that rely on Bluetooth communication.

The vulnerability exists in the Linux kernel’s hci_uart Bluetooth subsystem. Linux kernel distributions that include the unpatched hci_uart implementation are affected. No specific version range is listed, so any kernel variant that still contains the legacy init logic prior to the commit that introduces write‑lock clearing is considered vulnerable.

No CVSS score or EPSS data are provided. The issue is not listed in the CISA KEV catalog, suggesting it has not yet been publicly exploited. The attack vector appears to be local or requires an attacker who can inject data on the UART interface used by the Bluetooth HCI UART stack, which is typically accessible only to privileged users or through a physical connection. Exploitation would trigger a kernel crash, leading to a denial of service for affected services. Because the flaw does not depend on remote reachability, the overall risk for general public‑facing systems is moderate, but environments that expose the Bluetooth UART path could experience critical downtime if not patched.