he hci_uart_tty_open function in the HCI UART driver
(drivers/bluetooth/hci_ldisc.c) in the Linux kernel 2.6.36, and possibly
other versions, does not verify whether the tty has a write operation,
which allows local users to cause a denial of service (NULL pointer
dereference) via vectors related to the Bluetooth driver.
he hci_uart_tty_open function in the HCI UART driver bluetooth/ hci_ldisc. c) in the Linux kernel 2.6.36, and possibly
(drivers/
other versions, does not verify whether the tty has a write operation,
which allows local users to cause a denial of service (NULL pointer
dereference) via vectors related to the Bluetooth driver.