In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()
A NULL pointer dereference can occur in skb_dequeue() when processing a QCA firmware crash dump on WCN7851 (0489:e0f3).
[ 93.672166] Bluetooth: hci0: ACL memdump size(589824)
[ 93.672475] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 93.672517] Workqueue: hci0 hci_devcd_rx [bluetooth] [ 93.672598] RIP: 0010:skb_dequeue+0x50/0x80
The issue stems from handle_dump_pkt_qca() returning 0 even when a dump packet is successfully processed. This is because it incorrectly forwards the return value of hci_devcd_init() (which returns 0 on success). As a result, the caller (btusb_recv_acl_qca() or btusb_recv_evt_qca()) assumes the packet was not handled and passes it to hci_recv_frame(), leading to premature kfree() of the skb.
Later, hci_devcd_rx() attempts to dequeue the same skb from the dump queue, resulting in a NULL pointer dereference.
Fix this by: 1. Making handle_dump_pkt_qca() return 0 on success and negative errno on failure, consistent with kernel conventions. 2. Splitting dump packet detection into separate functions for ACL and event packets for better structure and readability.
This ensures dump packets are properly identified and consumed, avoiding double handling and preventing NULL pointer access.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 20, 2025 |
| Suse | — | Upgrade kernel-azureUpgrade kernel-debugUpgrade kernel-64kb-optionalUpgrade kernel-debug-develUpgrade gfs2-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-default-livepatchUpgrade kernel-kvmsmall-vdsoUpgrade cluster-md-kmp-rtUpgrade dtb-exynosUpgrade kernel-rt-vdsoUpgrade kernel-syms-azureUpgrade dtb-broadcomUpgrade kernel-develUpgrade kernel-devel-azureUpgrade kernel-azure-extraUpgrade dtb-caviumUpgrade dtb-alteraUpgrade dtb-appleUpgrade cluster-md-kmp-azureUpgrade dtb-lgUpgrade kernel-default-optionalUpgrade kernel-rt_debug-develUpgrade kernel-source-azureUpgrade dtb-qcomUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-azureUpgrade kernel-docs-htmlUpgrade kernel-sourceUpgrade gfs2-kmp-rtUpgrade kernel-azure-optionalUpgrade kernel-azure-develUpgrade dtb-freescaleUpgrade kernel-rtUpgrade dtb-marvellUpgrade kernel-rt-optionalUpgrade kernel-default-vdsoUpgrade kernel-kvmsmall-develUpgrade ocfs2-kmp-rtUpgrade dtb-hisiliconUpgrade kernel-zfcpdumpUpgrade dtb-allwinnerUpgrade dtb-amazonUpgrade kernel-kvmsmallUpgrade kernel-default-develUpgrade reiserfs-kmp-64kbUpgrade kernel-64kbUpgrade kselftests-kmp-azureUpgrade kernel-source-rtUpgrade kernel-source-vanillaUpgrade kernel-symsUpgrade ocfs2-kmp-64kbUpgrade dlm-kmp-defaultUpgrade kernel-64kb-extraUpgrade kernel-syms-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-macrosUpgrade dtb-armUpgrade dtb-amdUpgrade dlm-kmp-rtUpgrade dtb-amlogicUpgrade kernel-64kb-develUpgrade kernel-default-base-rebuildUpgrade dtb-nvidiaUpgrade ocfs2-kmp-azureUpgrade dtb-sprdUpgrade kernel-azure-vdsoUpgrade dtb-apmUpgrade cluster-md-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-default-extraUpgrade kernel-obs-buildUpgrade kernel-rt-develUpgrade kernel-docsUpgrade cluster-md-kmp-64kbUpgrade kernel-debug-vdsoUpgrade kernel-rt_debug-vdsoUpgrade gfs2-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade dtb-rockchipUpgrade kselftests-kmp-rtUpgrade dtb-socionextUpgrade kernel-rt-extraUpgrade kernel-default-baseUpgrade kernel-defaultUpgrade dtb-renesasUpgrade reiserfs-kmp-defaultUpgrade kernel-rt_debugUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-rtUpgrade dtb-xilinxUpgrade dtb-mediatekUpgrade kernel-obs-qaUpgrade kernel-devel-rtUpgrade kernel-default-livepatch-devel | Dec 5, 2025 | Jun 16, 2025 |
| Ubuntu | — | Upgrade linux-image-oem-22.04bUpgrade linux-image-virtual-6.14Upgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-ibm-6.8Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-raspi-6.14Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-kvmUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-gcpUpgrade linux-image-azure-fipsUpgrade linux-image-generic-lpaeUpgrade linux-image-gke-6.8Upgrade linux-image-6.14.0-1009-oracleUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.14.0-1009-oracle-64kUpgrade linux-image-aws-fips-6.8Upgrade linux-image-generic-64kUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-100-genericUpgrade linux-image-6.14.0-24-generic-64kUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-aws-6.8Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-raspiUpgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidiaUpgrade linux-image-oem-22.04aUpgrade linux-image-6.14.0-1009-aws-64kUpgrade linux-image-6.14.0-24-genericUpgrade linux-image-azure-fips-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-gkeop-6.8Upgrade linux-image-gke-64kUpgrade linux-image-ibm-classicUpgrade linux-image-oem-24.04aUpgrade linux-image-xilinxUpgrade linux-image-6.14.0-1006-oemUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-azureUpgrade linux-image-gcp-fipsUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.14.0-1011-gcp-64kUpgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oem-24.04cUpgrade linux-image-fips-6.8Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-ibmUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-oem-6.14Upgrade linux-image-oracle-6.14Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-virtual-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.14.0-1010-azureUpgrade linux-image-gcp-6.14Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-lowlatency-6.8Upgrade linux-image-aws-64kUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-azure-6.8Upgrade linux-image-azure-6.14Upgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-gkeopUpgrade linux-image-aws-6.14Upgrade linux-image-genericUpgrade linux-image-oracleUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-virtualUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-intel-iotgUpgrade linux-image-gcp-64kUpgrade linux-image-realtime-6.14Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-aws-fipsUpgrade linux-image-realtime-6.8.1Upgrade linux-image-6.14.0-1009-awsUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-6.14Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oem-24.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.14.0-1009-raspiUpgrade linux-image-xilinx-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-raspi-6.8Upgrade linux-image-6.14.0-1006-realtimeUpgrade linux-image-oracle-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-gkeUpgrade linux-image-aws-64k-6.14Upgrade linux-image-6.14.0-1011-gcpUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-64k-6.14Upgrade linux-image-fipsUpgrade linux-image-realtime | Jun 26, 2025 | May 20, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub