# CVE-2026-98294: Bluetooth: hci_qca: Do not write to the serial port after it is closed

CVE-2026-98294 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98294 (version 7.2.8-1), released October 6, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-98294
- Priority: High
- CVSS: 7.1 (Moderate)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 6, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98294

## Description

In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: hci_qca: Do not write to the serial port after it is closed  hci_uart_close() closes the serdev port if HCI_QUIRK_NON_PERSISTENT_SETUP is set (for example, for the WCN399x family). A failed hci_dev_open_sync() following a successful qca_setup() calls hdev->close() but not hdev->shutdown(), so the port is closed while power->vregs_on is left true. qca_serdev_remove() then passes its power->vregs_on test and calls qca_power_off(), which writes to the closed port unconditionally.  Seen on a WCN3988 by unbinding the driver after a controller failure. The trace below is from a 7.0.0 based kernel, where qca_power_off() was still named qca_power_shutdown():    Unable to handle kernel NULL pointer dereference at virtual address   0000000000000038   Call trace:    tty_set_termios+0x50/0x238 (P)    ttyport_set_baudrate+0x84/0xc0    serdev_device_set_baudrate+0x24/0x40    qca_power_shutdown+0x158/0x1fc [hci_uart]    qca_serdev_remove+0x54/0x68 [hci_uart]    serdev_drv_remove+0x1c/0x2c    device_remove+0x4c/0x80    device_release_driver_internal+0x1cc/0x224    device_driver_detach+0x18/0x24    unbind_store+0xb4/0xc0  Check HCI_UART_PROTO_READY, which hci_uart_close() clears in the same place it closes the port, before writing to it. The regulator disable is left unconditional so the controller is still powered down.  The dangling serport->tty that turns this into a use-after-free is addressed in a separate patch.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.8-1 | [DEBIAN-CVE-2026-98294](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98294.md) | Oct 6, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.