Answer in brief
CVE-2026-74303 records a Unknown severity vulnerability in Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=06d3fdfcdf5cefb06f2024b9d3dad356779399cf <809230cc25dde1d6bb00de2a1eeb5f3199402fbe || >=06d3fdfcdf5cefb06f2024b9d3dad356779399cf <a209744230f9ce3d7a7e9a0839944f5cb5fa02a4 || >=06d3fdfcdf5cefb06f2024b9d3dad356779399cf <e284bb94ad4512ec0bcd9b91bda99e67c507f7f8 || >=06d3fdfcdf5cefb06f2024b9d3dad356779399cf <d54a5fb7d821b88c7c5569d450af59dafccaf414 || >=06d3fdfcdf5cefb06f2024b9d3dad356779399cf <6b8cbcf08de0db62254d1981f83db0f94681ccd9 | 809230cc25dde1d6bb00de2a1eeb5f3199402fbe, a209744230f9ce3d7a7e9a0839944f5cb5fa02a4, e284bb94ad4512ec0bcd9b91bda99e67c507f7f8, d54a5fb7d821b88c7c5569d450af59dafccaf414, 6b8cbcf08de0db62254d1981f83db0f94681ccd9 |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device hu->serdev is NULL for hci_uart attached via non-serdev paths, but qca_dmp_hdr() unconditionally dereferences hu->serdev->dev.driver->name, causing a NULL pointer dereference. Fix by guarding the dereference with a NULL check and falling back to "hci_ldisc_qca" for the non-serdev case.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-74303 records a Unknown severity vulnerability in Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=06d3fdfcdf5cefb06f2024b9d3dad356779399cf <809230cc25dde1d6bb00de2a1eeb5f3199402fbe || >=06d3fdfcdf5cefb06f2024b9d3dad356779399cf <a209744230f9ce3d7a7e9a0839944f5cb5fa02a4 || >=06d3fdfcdf5cefb06f2024b9d3dad356779399cf <e284bb94ad4512ec0bcd9b91bda99e67c507f7f8 || >=06d3fdfcdf5cefb06f2024b9d3dad356779399cf <d54a5fb7d821b88c7c5569d450af59dafccaf414 || >=06d3fdfcdf5cefb06f2024b9d3dad356779399cf <6b8cbcf08de0db62254d1981f83db0f94681ccd9 | 809230cc25dde1d6bb00de2a1eeb5f3199402fbe, a209744230f9ce3d7a7e9a0839944f5cb5fa02a4, e284bb94ad4512ec0bcd9b91bda99e67c507f7f8, d54a5fb7d821b88c7c5569d450af59dafccaf414, 6b8cbcf08de0db62254d1981f83db0f94681ccd9 |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device hu->serdev is NULL for hci_uart attached via non-serdev paths, but qca_dmp_hdr() unconditionally dereferences hu->serdev->dev.driver->name, causing a NULL pointer dereference. Fix by guarding the dereference with a NULL check and falling back to "hci_ldisc_qca" for the non-serdev case.
Quoted source text, attributed separately from HOL analysis.