The Linux kernel’s hci_qca Bluetooth driver contains a NULL pointer dereference when a Bluetooth UART device is attached through a non‑serdev path. Because hu->serdev is NULL, the function qca_dmp_hdr() unconditionally accesses hu->serdev->dev.driver->name, leading to a kernel crash that can bring the system down. This flaw is a classic NULL pointer dereference (CWE‑476) that can result in a system‑wide denial of service, with no direct confidentiality or integrity impact.

All Linux kernel installations that include the hci_qca driver and have not yet incorporated the patch commits referenced in this advisory are vulnerable, particularly if the system supports non‑serdev Bluetooth UART devices. No specific kernel version ranges are listed; any unpatched kernel containing the driver should be considered at risk.

The CVSS score of 5.5 indicates a medium severity risk while the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to establish a connection to a non‑serdev Bluetooth UART device on the target system, which typically requires physical proximity or exploitation of the wireless link. The main consequence is a system crash that results in a denial of service; there is no known way for an attacker to compromise confidentiality or integrity through this flaw.