CVE-2026-98294

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_qca: Do not write to the serial port after it is closed

hci_uart_close() closes the serdev port if HCI_QUIRK_NON_PERSISTENT_SETUP

is set (for example, for the WCN399x family). A failed hci_dev_open_sync()

following a successful qca_setup() calls hdev->close() but not

hdev->shutdown(), so the port is closed while power->vregs_on is left true.

qca_serdev_remove() then passes its power->vregs_on test and calls

qca_power_off(), which writes to the closed port unconditionally.

Seen on a WCN3988 by unbinding the driver after a controller failure. The

trace below is from a 7.0.0 based kernel, where qca_power_off() was still

named qca_power_shutdown():

Unable to handle kernel NULL pointer dereference at virtual address

0000000000000038

Call trace:

tty_set_termios+0x50/0x238 (P)

ttyport_set_baudrate+0x84/0xc0

serdev_device_set_baudrate+0x24/0x40

qca_power_shutdown+0x158/0x1fc [hci_uart]

q

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References