{
  "cveId": "CVE-2026-98294",
  "url": "https://patchblox.com/security/cve/CVE-2026-98294",
  "summary": "CVE-2026-98294 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98294 (version 7.2.8-1), released October 6, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Bluetooth: hci_qca: Do not write to the serial port after it is closed",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: hci_qca: Do not write to the serial port after it is closed  hci_uart_close() closes the serdev port if HCI_QUIRK_NON_PERSISTENT_SETUP is set (for example, for the WCN399x family). A failed hci_dev_open_sync() following a successful qca_setup() calls hdev-\u003Eclose() but not hdev-\u003Eshutdown(), so the port is closed while power-\u003Evregs_on is left true. qca_serdev_remove() then passes its power-\u003Evregs_on test and calls qca_power_off(), which writes to the closed port unconditionally.  Seen on a WCN3988 by unbinding the driver after a controller failure. The trace below is from a 7.0.0 based kernel, where qca_power_off() was still named qca_power_shutdown():    Unable to handle kernel NULL pointer dereference at virtual address   0000000000000038   Call trace:    tty_set_termios\u002B0x50/0x238 (P)    ttyport_set_baudrate\u002B0x84/0xc0    serdev_device_set_baudrate\u002B0x24/0x40    qca_power_shutdown\u002B0x158/0x1fc [hci_uart]    qca_serdev_remove\u002B0x54/0x68 [hci_uart]    serdev_drv_remove\u002B0x1c/0x2c    device_remove\u002B0x4c/0x80    device_release_driver_internal\u002B0x1cc/0x224    device_driver_detach\u002B0x18/0x24    unbind_store\u002B0xb4/0xc0  Check HCI_UART_PROTO_READY, which hci_uart_close() clears in the same place it closes the port, before writing to it. The regulator disable is left unconditional so the controller is still powered down.  The dangling serport-\u003Etty that turns this into a use-after-free is addressed in a separate patch.",
  "published": "2026-10-06T09:18:19Z",
  "severity": "Moderate",
  "cvss": 7.1,
  "epss": 0.00173,
  "epssPercentile": 0.06817,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98294",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.8-1",
      "fix": "DEBIAN-CVE-2026-98294",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98294",
      "released": "2026-10-06T21:56:27Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}