The hci_uart_tty_open function in the HCI UART driver (drivers/bluetooth/hci_ldisc.c) in the Linux kernel 2.6.36, and possibly other versions, does not verify whether the tty has a write operation, which allows local users to cause a denial of service (NULL pointer dereference) via vectors related to the Bluetooth driver.

The hci_uart_tty_open function in the HCI UART driver (drivers/bluetooth/hci_ldisc.c) in the Linux kernel 2.6.36, and possibly other versions, does not verify whether the tty has a write operation, which allows local users to cause a denial of service (NULL pointer dereference) via vectors related to the Bluetooth driver.

kernel: sctp: do not reset the packet during sctp_packet_config kernel: prevent heap corruption in snd_ctl_new() kernel: guest->host denial of service from invalid xenbus transitions kernel: setup_arg_pages: diagnose excessive argument size kernel: tipc: heap overflow in tipc_msg_build() kernel: iovec integer overflow in net/rds/rdma.c kernel: net/packet/af_packet.c: reading uninitialized stack memory kernel: logic error in INET_DIAG bytecode auditing kernel: ipc/sem.c: reading uninitialized stack memory kernel: gdth: integer overflow in ioc_general() kernel: rhel5 commit 6865201191 caused deadlock kernel: missing tty ops write function presence check in hci_uart_tty_open() xen: request-processing loop is unbounded in blkback kernel: posix-cpu-timers: workaround to suppress the problems with mt exec