CVE-2026-74304

A flaw was found in the Bluetooth subsystem of the Linux kernel, specifically within the hci_qca module. This vulnerability occurs when the qca_setup() function is called for hci_uart devices connected through non-serdev paths, leading to a NULL pointer dereference. A local attacker could potentially exploit this to cause a system crash, resulting in a Denial of Service (DoS).

This vulnerability is rated with a Low impact because exploitation requires local system privileges and specific hardware interactions, with consequences limited to a system crash without compromising confidentiality or integrity. Enterprise Linux kernels shipped by Red Hat do not incorporate the upstream code changes that introduced this flaw, rendering supported deployments unaffected. Furthermore, triggering the condition requires attaching Qualcomm Bluetooth UART devices via non-serdev interfaces, an atypical configuration in standard server environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.