---
id: CVE-2026-74304
title: >-
  In the Linux kernel, the following vulnerability has been resolved:


  Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev
  device


  hu->serdev is NULL for hci_uart attached via non-serdev paths, but

  qca_setup() un…
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev
  device


  hu->serdev is NULL for hci_uart attached via non-serdev paths, but

  qca_setup() un…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7812a441617ad7cf3e62281d3fa518d2ba17c100 <
    74f179e75ab03bdc818a5e9709d8a8440c351463
  - >-
    Linux >= 22d893eec0d52fa97d25d3de248285648f26ef68 <
    0704c04769ccc1a0939682db35d816dfa5fe75dc
  - >-
    Linux >= 22d893eec0d52fa97d25d3de248285648f26ef68 <
    3ec629fee178d429f01ae843e4ea888de93012bf
  - Linux 7.0
published: '2026-08-15'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T15:17:55.293'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74304'
references:
  - url: 'https://git.kernel.org/stable/c/0704c04769ccc1a0939682db35d816dfa5fe75dc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3ec629fee178d429f01ae843e4ea888de93012bf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/74f179e75ab03bdc818a5e9709d8a8440c351463'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00198
epssPercentile: 0.08541
ingestedAt: '2026-09-25T15:10:56.361Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device

hu->serdev is NULL for hci_uart attached via non-serdev paths, but
qca_setup() unconditionally calls serdev_device_get_drvdata(hu->serdev)
and dereferences the result, causing a NULL pointer dereference.

Fix by guarding the dereference with a NULL check, consistent with the
rest of qca_setup().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.