CVE-2026-98294: Bluetooth: hci_qca: Do not write to the serial port after it is closed
Bluetooth: hciqca: Do not write to the serial port after it is closed
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Before writing to the serial port in the Qualcomm HCI UART power-off/shutdown path, check HCI_UART_PROTO_READY, which hci_uart_close() clears when it closes the port.
Event History
Frequently Asked Questions
Which systems are most likely to be affected?
The issue applies to Linux systems using the hci_qca Bluetooth driver with HCI_QUIRK_NON_PERSISTENT_SETUP, such as the WCN399x family. It was observed specifically on WCN3988 hardware.
What conditions are needed to trigger the failure?
A successful qca_setup() must be followed by a failed hci_dev_open_sync(), leaving power->vregs_on set while the serdev port has been closed. Unbinding the driver after that controller failure can then cause the remove path to write to the closed port.
How can I recognize that this issue has occurred?
The reported symptom is a kernel NULL pointer dereference during driver removal. The call trace can include tty_set_termios, ttyport_set_baudrate, serdev_device_set_baudrate, qca_power_shutdown or qca_power_off, and qca_serdev_remove.