CVE-2024-35850

What it actually does

Missing sanity check allows NULL dereference in qca setup() path when HCI UART serdev pointer is absent on non-serdev Qualcomm ROME Bluetooth controllers.

Why it matters to the business

Kernel panic or denial of service on systems using affected Bluetooth hardware during controller initialization, increasing downtime risk for Linux-based devices and servers with high ecosystem prevalence.

How an attack unfolds

An attacker with local access or ability to trigger Bluetooth registration on a non-serdev Qualcomm ROME controller causes the kernel to call setup() without a valid serdev pointer, dereferencing NULL and crashing the system; no named threat actors are confirmed exploiting this specific flaw.

How to fix it

Update the Linux kernel to commit 67459f1a707aae6d590454de07956c2752e21ea4 or later stable releases containing the fix; apply vendor-supplied kernel updates promptly.

How to confirm the fix worked

Verify kernel source contains the sanity check added in commit 67459f1a707aae6d590454de07956c2752e21ea4; test Bluetooth initialization on affected hardware post-update to confirm absence of dereference.

Typical attack path

1. Identify or configure a non-serdev Qualcomm ROME Bluetooth controller registration via Bluetooth line discipline
2. Trigger HCI UART setup() function without serdev context
3. Kernel performs NULL pointer access leading to oops or panic

How to detect it

Review kernel logs for NULL pointer dereference oops traces referencing qca or hci_uart serdev during Bluetooth setup; no confirmed exploitation artifacts from known campaigns.

What your security team should do

• Prioritize kernel updates on all affected Linux systems within standard patch windows given low EPSS and no KEV listing
• Monitor for Bluetooth-related kernel oops reports in system logs
• Disable unused Bluetooth controllers where feasible until patched