CVE-2026-74304 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device
hu->serdev is NULL for hci_uart attached via non-serdev paths, but qca_setup() unconditionally calls serdev_device_get_drvdata(hu->serdev) and dereferences the result, causing a NULL pointer dereference.
Fix by guarding the dereference with a NULL check, consistent with the rest of qca_setup().
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability represents a critical null pointer dereference flaw in the Linux kernel's Bluetooth subsystem specifically affecting the Qualcomm QCA (QCA6174) Bluetooth controller driver. The issue manifests within the hci_qca module where the qca_setup() function attempts to access device driver data without proper validation of the serial device structure pointer. When a Bluetooth UART device is attached through non-serdev pathways, the hu->serdev member remains uninitialized as NULL, yet the function proceeds to invoke serdev_device_get_drvdata() on this null reference, leading to immediate system crash or potential privilege escalation depending on exploitation context.
The technical root cause stems from inadequate input validation within the qca_setup() function which operates under the assumption that all Bluetooth UART devices will utilize the serial device framework. This design flaw violates fundamental security principles of defensive programming and demonstrates a failure to properly handle edge cases in device initialization sequences. The vulnerability maps directly to CWE-476 which describes null pointer dereference conditions, while also aligning with ATT&CK technique T1068 related to privilege escalation through kernel-level vulnerabilities.
The operational impact of this vulnerability extends beyond simple system crashes to potentially enable malicious actors to gain unauthorized access to system resources. When exploited, the null pointer dereference can cause kernel oops messages leading to system instability and service disruption, while in more sophisticated attack scenarios could provide a foothold for privilege escalation attacks targeting the kernel's Bluetooth subsystem. The vulnerability affects systems running Linux kernels with Bluetooth support where Qualcomm QCA6174 controllers are configured without proper serdev device handling.
Mitigation strategies should focus on immediate patch application to address the null pointer dereference issue through proper conditional validation before accessing driver data structures. System administrators must ensure all kernel updates are applied promptly, particularly in environments where Bluetooth connectivity is critical or where systems may be exposed to untrusted network conditions. Additional defensive measures include implementing proper device initialization sequence validation and ensuring that kernel modules properly validate their dependencies before attempting to access related subsystems. The fix implements a straightforward conditional check that aligns with established kernel development practices for handling optional device framework components, preventing the null pointer dereference while maintaining full compatibility with both serdev and non-serdev device attachment paths.