CVE-2026-74303

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

CVE-2026-74304 Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcasetup for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcasetup unconditionally calls serdevdevicegetdrvdatahu-serdev and dereferences th...

EUVD-2026-59451

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcasetup for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcasetup unconditionally calls serdevdevicegetdrvdatahu-serdev and dereferences th...

EUVD-2026-59450

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: It is necessary to call deltimersync before freeing a timer. A crash report indicated that the timer list might become corrupted when a timer is freed while still active. This issue is commonly caused by code...

EUVD-2022-54677

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Use deltimersync before freeing While looking at a crash report on a timer list being corrupted, which usually happens when a timer is freed while still active. This is commonly triggered by code calling deltim...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414324)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414324 advisory. In the Linux kernel before 5.16.3, drivers/bluetooth/hciqca.c misinterprets the devmgpiodgetindexoptional return value expects it to be NULL in the error case, where...

CVE-2022-49555

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Use deltimersync before freeing While looking at a crash report on a timer list being corrupted, which usually happens when a timer is freed while still active. This is commonly triggered by code calling deltim...

CVE-2022-49555 Bluetooth: hci_qca: Use del_timer_sync() before freeing

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Use deltimersync before freeing While looking at a crash report on a timer list being corrupted, which usually happens when a timer is freed while still active. This is commonly triggered by code calling deltim...

CVE-2022-49555

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Use deltimersync before freeing While looking at a crash report on a timer list being corrupted, which usually happens when a timer is freed while still active. This is commonly triggered by code calling deltim...

CVE-2022-49555

Summary: CVE-2022-49555 is tied to the Linux kernel Bluetooth subsystem (hci_qca). The issue arises when a timer is freed while still active due to code calling del_timer() instead of del_timer_sync(), risking timer-list corruption. The description notes that the hci_qca driver may trigger this, ...

CVE-2022-48878

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Fix driver shutdown on closed serdev The driver shutdown callback which sends EDLSOCRESET to the device over serdev should not be invoked when HCI device is not open e.g. if hcidevopensync failed, because the...

CVE-2022-48878

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Fix driver shutdown on closed serdev The driver shutdown callback which sends EDLSOCRESET to the device over serdev should not be invoked when HCI device is not open e.g. if hcidevopensync failed, because the...

CVE-2022-48878 Bluetooth: hci_qca: Fix driver shutdown on closed serdev

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Fix driver shutdown on closed serdev The driver shutdown callback which sends EDLSOCRESET to the device over serdev should not be invoked when HCI device is not open e.g. if hcidevopensync failed, because the...

CVE-2024-35851

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NULL-deref on non-serdev suspend Qualcomm ROME controllers can be registered from the Bluetooth line discipline and in this case the HCI UART serdev pointer is NULL. Add the missing sanity check to prevent a...

GSD-2023-1002181 Bluetooth: hci_qca: Fix driver shutdown on closed serdev

Bluetooth: hciqca: Fix driver shutdown on closed serdev This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.165 by commit...

GSD-2023-1002113 Bluetooth: hci_qca: Fix driver shutdown on closed serdev

Bluetooth: hciqca: Fix driver shutdown on closed serdev This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.90 by commit...

GSD-2023-1001983 Bluetooth: hci_qca: Fix driver shutdown on closed serdev

Bluetooth: hciqca: Fix driver shutdown on closed serdev This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.8 by commit...

GSD-2023-1001785 Bluetooth: hci_qca: Fix driver shutdown on closed serdev

Bluetooth: hciqca: Fix driver shutdown on closed serdev This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.165 by commit...

GSD-2023-1001751 Bluetooth: hci_qca: Fix driver shutdown on closed serdev

Bluetooth: hciqca: Fix driver shutdown on closed serdev This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.90 by commit...