CVE-2026-74303

A flaw was found in the Linux kernel's Bluetooth subsystem. The qca_dmp_hdr() function, when handling non-serdev devices, attempts to dereference a NULL pointer without proper validation. An attacker could potentially trigger this condition, leading to a system crash and a denial of service.

This vulnerability is evaluated as Moderate in severity because exploitation requires local access and is confined to causing a kernel panic, with no possibility of privilege escalation or data confidentiality loss. Red Hat Enterprise Linux is not vulnerable to this flaw because the affected Qualcomm Bluetooth driver functionality was not introduced into supported enterprise kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.