CVE-2026-31510
Null Pointer Dereference in Linux Bluetooth L2CAP Causing Kernel Panic
Publication date: 2026-04-22
Last updated on: 2026-04-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 3.6 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 5.11 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.168 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.21 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.131 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.80 (exc) |
| linux | linux_kernel | From 3.6.1 (inc) to 5.10.253 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a null pointer dereference in the Linux kernel's Bluetooth L2CAP component. Specifically, the function l2cap_sock_ready_cb did not check if a socket pointer (sk) was null before using it, which could cause the kernel to dereference a null pointer.
The issue was detected by Kernel Address Sanitizer (KASAN) as a null pointer dereference in a specific memory range, which can lead to a kernel panic or crash.
The fix involved adding a check to ensure the socket pointer is not null before it is used, preventing the null pointer dereference.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a null pointer dereference in the Linux kernel Bluetooth L2CAP component, which can cause kernel panics or crashes. Detection would typically involve monitoring system logs for kernel panic messages or crash traces related to Bluetooth or L2CAP.
You can check your system logs for relevant kernel panic or error messages using commands such as:
- dmesg | grep -i l2cap
- journalctl -k | grep -i bluetooth
- journalctl -k | grep -i 'null-ptr-deref'
Additionally, monitoring for unexpected kernel panics or crashes related to Bluetooth activity may indicate exploitation or triggering of this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been fixed by adding a check for null pointers before using the sk pointer in the Bluetooth L2CAP code of the Linux kernel.
Immediate mitigation steps include:
- Update your Linux kernel to a version that includes the fix for this vulnerability.
- If updating immediately is not possible, consider disabling Bluetooth functionality temporarily to reduce exposure.
- Monitor system logs for any signs of kernel panics or crashes related to Bluetooth and investigate accordingly.
How can this vulnerability impact me? :
This vulnerability can cause a kernel panic or crash due to a null pointer dereference in the Bluetooth L2CAP code of the Linux kernel.
Such a crash can lead to denial of service (DoS) conditions, making the affected system unstable or unavailable until it is rebooted.