Executive brief
The Linux kernel's Bluetooth QCA driver can crash when certain Bluetooth devices are attached via non-serial device paths. The crash occurs because the driver attempts to access device configuration without first checking if the configuration data exists, causing the system to experience a service interruption. This affects systems with specific Qualcomm Bluetooth chipsets that use alternative connection paths.
Technical details
A NULL pointer dereference vulnerability exists in the qca_setup() function in drivers/bluetooth/hci_qca.c. The vulnerable code unconditionally calls serdev_device_get_drvdata(hu->serdev) and dereferences the result without verifying that hu->serdev is non-NULL. For hci_uart devices attached via non-serdev paths, hu->serdev is NULL, triggering a kernel crash. The fix adds a NULL check before dereferencing qcadev in multiple locations (around line 1916, 1983, and 2076) to guard accesses to qcadev->bdaddr_property_broken and qcadev->support_hfp_hw_offload. The vulnerability was introduced by commit 22d893eec0d5 and is patched in upstream and stable kernel branches.
Affected products
- Linux Linux kernel affected versions include multiple branches (upstream through stable); patched in commit 3ec629fee178d429f01ae843e4ea888de93012bf
Timeline
- 2026-08-15: disclosed
- 2026-06-11: patched: upstream fix committed