Executive brief
The Linux kernel's Bluetooth QCA driver (hci_qca) contains a bug in device dump header handling that can crash systems with certain Bluetooth hardware configurations. When a Bluetooth device is attached via non-serial paths, the driver attempts to access uninitialized memory, causing a kernel panic that renders Bluetooth connectivity unavailable until the system reboots.
Technical details
The vulnerability is a NULL pointer dereference in the qca_dmp_hdr() function within drivers/bluetooth/hci_qca.c. The code unconditionally dereferences hu->serdev->dev.driver->name without checking whether hu->serdev is NULL, which occurs when hci_uart is attached via non-serdev paths. An attacker with local access or a malfunctioning Bluetooth device can trigger this code path during coredump generation, causing a kernel panic. The fix guards the dereference with a NULL check and falls back to "hci_ldisc_qca" for the non-serdev case. A patch was committed upstream on 2026-06-11 and backported to stable kernel branches.
Affected products
- Linux Linux kernel All versions with Bluetooth hci_qca driver (fixed in commit 6b8cbcf08de0db62254d1981f83db0f94681ccd9)
Timeline
- 2026-08-15: disclosed: CVE published
- 2026-06-11: patched: Upstream fix committed (commit 6b8cbcf08de0db62254d1981f83db0f94681ccd9)
- 2026-07-24: patched: Backported to stable kernel branches