UBUNTU-CVE-2026-98294: Use After Free

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Do not write to the serial port after it is closed hciuartclose() closes the serdev port if HCIQUIRKNONPERSISTENTSETUP is set (for example, for the WCN399x family). A failed hcidevopensync() following a successful qcasetup() calls hdev->close() but not hdev->shutdown(), so the port is closed while power->vregson is left true. qcaserdevremove() then passes its power->vregson test and calls qcapoweroff(), which writes to the closed port unconditionally. Seen on a WCN3988 by unbinding the driver after a controller failure. The trace below is from a 7.0.0 based kernel, where qcapoweroff() was still named qcapowershutdown(): Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 Call trace: ttysettermios+0x50/0x238 (P) ttyportsetbaudrate+0x84/0xc0 serdevdevicesetbaudrate+0x24/0x40 qcapowershutdown+0x158/0x1fc [hciuart] qcaserdevremove+0x54/0x68 [hciuart] serdevdrvremove+0x1c/0x2c deviceremove+0x4c/0x80 devicereleasedriverinternal+0x1cc/0x224 devicedriverdetach+0x18/0x24 unbindstore+0xb4/0xc0 Check HCIUARTPROTOREADY, which hciuartclose() clears in the same place it closes the port, before writing to it. The regulator disable is left unconditional so the controller is still powered down. The dangling serport->tty that turns this into a use-after-free is addressed in a separate patch.