Junglewise Threat Intelligence

CVE-2026-74304: Linux kernel Bluetooth hci_qca NULL pointer dereference in qca_setup()

CVE-2026-74304 · Severity: info · Published 2026-08-15

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's Bluetooth QCA driver can crash when certain Bluetooth devices are attached via non-serial device paths. The crash occurs because the driver attempts to access device configuration without first checking if the configuration data exists, causing the system to experience a service interruption. This affects systems with specific Qualcomm Bluetooth chipsets that use alternative connection paths.

Technical details

A NULL pointer dereference vulnerability exists in the qca_setup() function in drivers/bluetooth/hci_qca.c. The vulnerable code unconditionally calls serdev_device_get_drvdata(hu->serdev) and dereferences the result without verifying that hu->serdev is non-NULL. For hci_uart devices attached via non-serdev paths, hu->serdev is NULL, triggering a kernel crash. The fix adds a NULL check before dereferencing qcadev in multiple locations (around line 1916, 1983, and 2076) to guard accesses to qcadev->bdaddr_property_broken and qcadev->support_hfp_hw_offload. The vulnerability was introduced by commit 22d893eec0d5 and is patched in upstream and stable kernel branches.

Affected products

  • Linux Linux kernel affected versions include multiple branches (upstream through stable); patched in commit 3ec629fee178d429f01ae843e4ea888de93012bf

Timeline

  • 2026-08-15: disclosed
  • 2026-06-11: patched: upstream fix committed

References

Related threats