DEBIAN-CVE-2026-80975

In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnapmcuexec publishes an on-stack buffer to the receive path: unsigned char rxQNAPMCURXBUFFERSIZE; ... reply-data = rx; reply-length = length; and qnapmcureceivebu...

CVE-2026-80975

In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnapmcuexec publishes an on-stack buffer to the receive path: unsigned char rxQNAPMCURXBUFFERSIZE; ... reply-data = rx; reply-length = length; and qnapmcureceivebu...

CVE-2026-80975

In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnapmcuexec publishes an on-stack buffer to the receive path: unsigned char rxQNAPMCURXBUFFERSIZE; ... reply-data = rx; reply-length = length; and qnapmcureceivebu...

CVE-2026-80975

CVE-2026-80975 is a use-after-free vulnerability in the Linux kernel's qnap-mcu MFD driver. When a command times out or a write fails, qnap_mcu_exec() returns while reply->data still points to its own stack frame. A late MCU reply or unsolicited message written by the serdev receive path then ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Fixed a NULL pointer dereferencing in qcasetup, which occurred for non-serdev devices. For devices connected via non-serdev paths, hu-serdev is NULL. However, qcasetup serdevdevicegetdrvdatahu-serdev and...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hciqca: Fixed the driver shutdown when the serdev is closed. The driver shutdown callback which sends EDLSOCRESET to the device via serdev should not be invoked when the HCI device is not open e.g., if hcidevopensyn...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Allocate the receive skb before consuming bytes. The function pn532receivebuf reports the number of accepted bytes to the serdev core. The current code consumes bytes into the recvskb, and may have already passed a...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NULL-dereferencing on non-serdev controllers during suspension Qualcomm ROME controllers can be registered through the Bluetooth interface. In this case, the HCI UART serdev pointer is NULL. A missing sanity...

CVE-2026-74304

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcasetup for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcasetup unconditionally calls serdevdevicegetdrvdatahu-serdev and dereferences th...

CVE-2026-74303

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

UBUNTU-CVE-2026-74303

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

CVE-2026-74303

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

EUVD-2026-59451

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcasetup for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcasetup unconditionally calls serdevdevicegetdrvdatahu-serdev and dereferences th...

CVE-2026-74304

The CVE-2026-74304 issue affects the Linux kernel Bluetooth hci_qca driver. In qca_setup(), hu->serdev may be NULL for hci_uart attached via non-serdev paths, yet the code unconditionally calls serdev_device_get_drvdata(hu->serdev) and dereferences it, causing a NULL pointer dereference. Th...

CVE-2026-74303 Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

CVE-2026-74303

The CVE-2026-74303 issue concerns the Linux kernel Bluetooth stack (hci_qca). A NULL pointer dereference occurs in qca_dmp_hdr() when handling non-serdev devices: hu->serdev is NULL for hci_uart attached via non-serdev paths, yet the function dereferences hu->serdev->dev.driver->name....

CVE-2026-74303 Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

EUVD-2026-59450

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

CVE-2026-74304 Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcasetup for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcasetup unconditionally calls serdevdevicegetdrvdatahu-serdev and dereferences th...

PT-2026-72739

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci qca: fix NULL pointer dereference in qca dmp hdr for non-serdev device hu-serdev is NULL for hci uart attached via non-serdev paths, but qca dmp hdr unconditionally dereferences hu-serdev-dev.driver-name, causing a...