CVE-2026-63991
Received Received - Intake

Bluetooth NULL Pointer Dereference in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() The skb_clone() function can return NULL if memory allocation fails. send_mcast_pkt() calls skb_clone() without checking the return value, which can lead to a NULL pointer dereference in send_pkt() when it dereferences skb->data. Add a NULL check after skb_clone() and skip the peer if the clone fails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63991
EUVD
EUVD-2026-45564

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel's Bluetooth 6lowpan implementation. The issue occurs in the send_mcast_pkt() function which calls skb_clone() without checking if it returns NULL. If memory allocation fails, skb_clone() returns NULL, leading to a NULL pointer dereference in send_pkt() when it tries to access skb->data.

Detection Guidance

This vulnerability involves a NULL pointer dereference in the Linux kernel's Bluetooth 6lowpan module due to unchecked skb_clone() return values. Detection requires checking kernel logs for crashes or errors related to Bluetooth or 6lowpan functionality.

Impact Analysis

This vulnerability could cause a system crash or denial of service if exploited. Attackers might trigger the NULL pointer dereference by sending specially crafted Bluetooth packets, potentially leading to kernel panic or system instability.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel issue related to memory allocation failure in Bluetooth 6lowpan functionality. No evidence suggests it impacts data protection or privacy requirements.

Mitigation Strategies

Apply the Linux kernel patch that adds a NULL check after skb_clone() in send_mcast_pkt(). Update to a patched kernel version if available. Monitor kernel logs for related errors as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63991. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart