CVE-2026-74304
- Source
- https://cve.org/CVERecord?id=CVE-2026-74304
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74304.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-74304
- Downstream
- Published
- 2026-08-15T05:58:05.981Z
- Modified
- 2026-08-16T03:48:33.629349552Z
- Summary
- Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hciqca: fix NULL pointer dereference in qcasetup() for non-serdev device
hu->serdev is NULL for hciuart attached via non-serdev paths, but qcasetup() unconditionally calls serdevdeviceget_drvdata(hu->serdev) and dereferences the result, causing a NULL pointer dereference.
Fix by guarding the dereference with a NULL check, consistent with the rest of qca_setup().
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74304.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/0704c04769ccc1a0939682db35d816dfa5fe75dc
- https://git.kernel.org/stable/c/3ec629fee178d429f01ae843e4ea888de93012bf
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74304.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-74304
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git