Linux Kernel Bluetooth NULL Pointer Dereference Vulnerability in btusb Component

A NULL pointer dereference vulnerability has been identified in the Linux kernel's Bluetooth subsystem, specifically within the btusb component. This issue arises when processing a QCA firmware crash dump on the WCN7851 chipset. The vulnerability occurs because the function handle_dump_pkt_qca() incorrectly returns a success value, leading to the premature deallocation of a socket buffer (skb). When the Bluetooth device driver subsequently attempts to dequeue the same skb from the dump queue, it results in a NULL pointer dereference.

Impact

Exploitation of this vulnerability leads to a kernel NULL pointer dereference, causing a crash in the Bluetooth subsystem.