CVE-2026-98294 - Vulnerability Details

- Bluetooth: hci_qca: Do not write to the serial port after it is closed

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_qca: Do not write to the serial port after it is closed

hci_uart_close() closes the serdev port if HCI_QUIRK_NON_PERSISTENT_SETUP
is set (for example, for the WCN399x family). A failed hci_dev_open_sync()
following a successful qca_setup() calls hdev->close() but not
hdev->shutdown(), so the port is closed while power->vregs_on is left true.
qca_serdev_remove() then passes its power->vregs_on test and calls
qca_power_off(), which writes to the closed port unconditionally.

Seen on a WCN3988 by unbinding the driver after a controller failure. The
trace below is from a 7.0.0 based kernel, where qca_power_off() was still
named qca_power_shutdown():

Unable to handle kernel NULL pointer dereference at virtual address
0000000000000038
Call trace:
tty_set_termios+0x50/0x238 (P)
ttyport_set_baudrate+0x84/0xc0
serdev_device_set_baudrate+0x24/0x40
qca_power_shutdown+0x158/0x1fc [hci_uart]
qca_serdev_remove+0x54/0x68 [hci_uart]
serdev_drv_remove+0x1c/0x2c
device_remove+0x4c/0x80
device_release_driver_internal+0x1cc/0x224
device_driver_detach+0x18/0x24
unbind_store+0xb4/0xc0

Check HCI_UART_PROTO_READY, which hci_uart_close() clears in the same place
it closes the port, before writing to it. The regulator disable is left
unconditional so the controller is still powered down.

The dangling serport->tty that turns this into a use-after-free is
addressed in a separate patch.

Published: 2026-10-06

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Based on the description, it is inferred that the Linux kernel’s Bluetooth hci_qca driver closes the serial port but then attempts to write to the closed port during cleanup. This leads to a NULL pointer dereference and a kernel crash that can render the operating system unavailable.

Affected Systems

It affects Linux kernel configurations that include the hci_qca driver for Qualcomm WCN399x family devices such as the WCN3988. Any kernel containing the buggy code before the patch, notably 7.0.0‑based kernels and later releases without the recent commit, is susceptible.

Risk and Exploitability

Based on the description, it is inferred that the primary attack vector is local; an attacker would need to trigger a controller failure or unbind the driver to cause the fault. No documented remote exploitation exists, so only local. The EPSS score is under 1%, and the CVE is not listed in CISA KEV. Given the CVSS score of 5.5, indicating moderate severity, this poses a moderate local denial‑of‑service risk, but the low exploitation probability limits its threat in most environments.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fa9ad876b8e0ebd2b4367ef1580f89be64ebd5d3`	affected	< a5414b0a9464b863733c8bd97493cb443a210ec4
`fa9ad876b8e0ebd2b4367ef1580f89be64ebd5d3`	affected	< 15754e4ec47ac5d117c9609c34a49ed6980ac4a1
`fa9ad876b8e0ebd2b4367ef1580f89be64ebd5d3`	affected	< 4e93c65f87825e1e012bce56615320aeb123815d

Linux

affected

Version	Status	Constraints
`4.19`	affected	—
`0`	unaffected	< 4.19
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[fa9ad876b8e0ebd2b4367ef1580f89be64ebd5d3,a5414b0a9464b863733c8bd97493cb443a210ec4)`	affected	code_commit	—
`[fa9ad876b8e0ebd2b4367ef1580f89be64ebd5d3,15754e4ec47ac5d117c9609c34a49ed6980ac4a1)`	affected	code_commit	—
`[fa9ad876b8e0ebd2b4367ef1580f89be64ebd5d3,4e93c65f87825e1e012bce56615320aeb123815d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.19`	affected	generic	—
`[0,4.19)`	unaffected	generic	—
`[6.18.54,6.19.0)`	unaffected	semver	—
`[7.2.8,7.3.0)`	unaffected	semver	—
`[7.3-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that contains the hci_qca patch (commit 15754e4ec47ac5d117c9609c34a49ed6980ac4a1).
If an update is not immediately available, disable the hci_uart driver for Qualcomm devices by blacklisting the module or unbinding the device through sysfs before it encounters a failure.
Continuously monitor system logs for NULL pointer dereference messages; reboot the system promptly when a crash occurs and apply the patch as soon as possible.

Generated by OpenCVE AI on October 11, 2026 at 16:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98294.mbox
https://git.kernel.org/stable/c/15754e4ec47ac5d117c9609c34a49ed6980ac4a1
https://git.kernel.org/stable/c/4e93c65f87825e1e012bce56615320aeb123815d
https://git.kernel.org/stable/c/a5414b0a9464b863733c8bd97493cb443a210ec4
https://nvd.nist.gov/vuln/detail/CVE-2026-98294
https://www.cve.org/CVERecord?id=CVE-2026-98294

History

Sun, 11 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98294.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98294 https://www.cve.org/CVERecord?id=CVE-2026-98294
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Tue, 06 Oct 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416 CWE-476

Tue, 06 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416 CWE-476

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Do not write to the serial port after it is closed hci_uart_close() closes the serdev port if HCI_QUIRK_NON_PERSISTENT_SETUP is set (for example, for the WCN399x family). A failed hci_dev_open_sync() following a successful qca_setup() calls hdev->close() but not hdev->shutdown(), so the port is closed while power->vregs_on is left true. qca_serdev_remove() then passes its power->vregs_on test and calls qca_power_off(), which writes to the closed port unconditionally. Seen on a WCN3988 by unbinding the driver after a controller failure. The trace below is from a 7.0.0 based kernel, where qca_power_off() was still named qca_power_shutdown(): Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 Call trace: tty_set_termios+0x50/0x238 (P) ttyport_set_baudrate+0x84/0xc0 serdev_device_set_baudrate+0x24/0x40 qca_power_shutdown+0x158/0x1fc [hci_uart] qca_serdev_remove+0x54/0x68 [hci_uart] serdev_drv_remove+0x1c/0x2c device_remove+0x4c/0x80 device_release_driver_internal+0x1cc/0x224 device_driver_detach+0x18/0x24 unbind_store+0xb4/0xc0 Check HCI_UART_PROTO_READY, which hci_uart_close() clears in the same place it closes the port, before writing to it. The regulator disable is left unconditional so the controller is still powered down. The dangling serport->tty that turns this into a use-after-free is addressed in a separate patch.
Title		Bluetooth: hci_qca: Do not write to the serial port after it is closed
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/15754e4ec47ac5d117c9609c34a49ed6980ac4a1 https://git.kernel.org/stable/c/4e93c65f87825e1e012bce56615320aeb123815d https://git.kernel.org/stable/c/a5414b0a9464b863733c8bd97493cb443a210ec4

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:45:53.338Z

Updated: 2026-10-19T09:17:05.335Z

Reserved: 2026-09-25T10:25:14.336Z

Link: CVE-2026-98294

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:19.887

Modified: 2026-10-19T10:18:31.170

Link: CVE-2026-98294

Redhat

Severity : Moderate

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98294 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-11T16:30:17Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object