A null pointer dereference in the hci_qca driver’s qca_setup() function allows a crash when a Bluetooth controller is attached via a non-serdev path. The crash occurs because the code attempts to obtain driver data from a null "serdev" object and dereferences the result, leading to a kernel panic and nearby system reboot. This yields a loss of availability of the affected system and any services that depend on it.

The flaw exists in any Linux kernel that includes the unpatched hci_qca driver. Because the issue arises prior to the commit that added the null-check release, any kernel built with that driver before the update is potentially vulnerable. The vendor in question is Linux and the kernel itself is the affected product.

The vulnerability has a CVSS score of 5.5 and is not present in the CISA KEV catalog, but the EPSS score indicates a very low but non-zero exploitation probability (less than 1%). Based on the description, it is inferred that the attack vector is local or physical, requiring an attacker to have direct access to the target system to trigger qca_setup() through a non-serdev Bluetooth device. If an attacker can supply or connect such a device, the kernel crash can be forced, causing a denial of service. No remote exploitation path is documented, yet the local impact remains high due to the kernel panic.