Bluetooth Null Pointer Dereference in Linux Kernel

Publication date: 2026-05-26

Last updated on: 2026-06-26

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Add the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-26

Last Modified

2026-06-26

Generated

2026-07-06

AI Q&A

2026-05-26

EPSS Evaluated

2026-07-04

NVD

CVE-2026-45836

EUVD

EUVD-2026-31858

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.30 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.7 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.140 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.90 (exc)
linux	linux_kernel	From 3.13 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a null pointer dereference issue in the Linux kernel's Bluetooth L2CAP component. Specifically, it occurs in the function l2cap_sock_get_sndtimeo_cb(). The fix involves adding a NULL pointer check similar to those already present in related functions l2cap_sock_resume_cb() and l2cap_sock_ready_cb().

Impact Analysis

A null pointer dereference vulnerability can cause the affected system or component to crash or behave unpredictably, potentially leading to denial of service. In this case, exploitation could disrupt Bluetooth functionality in the Linux kernel.

Hi! I’m here to help you understand CVE-2026-45836. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70