CVE-2026-63991

Analyzed Analyzed - Analysis Complete

Bluetooth NULL Pointer Dereference in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-10-07

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() The skb_clone() function can return NULL if memory allocation fails. send_mcast_pkt() calls skb_clone() without checking the return value, which can lead to a NULL pointer dereference in send_pkt() when it dereferences skb->data. Add a NULL check after skb_clone() and skip the peer if the clone fails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-07

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-07

NVD

CVE-2026-63991

EUVD

EUVD-2026-45564

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.93 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)
linux	linux_kernel	From 3.14 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's Bluetooth 6lowpan implementation. The issue occurs in the send_mcast_pkt() function which calls skb_clone() without checking if it returns NULL. If memory allocation fails, skb_clone() returns NULL, leading to a NULL pointer dereference in send_pkt() when it tries to access skb->data.

Detection Guidance

This vulnerability involves a NULL pointer dereference in the Linux kernel's Bluetooth 6lowpan module due to unchecked skb_clone() return values. Detection requires checking kernel logs for crashes or errors related to Bluetooth or 6lowpan functionality.

Impact Analysis

This vulnerability could cause a system crash or denial of service if exploited. Attackers might trigger the NULL pointer dereference by sending specially crafted Bluetooth packets, potentially leading to kernel panic or system instability.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel issue related to memory allocation failure in Bluetooth 6lowpan functionality. No evidence suggests it impacts data protection or privacy requirements.

Mitigation Strategies

Apply the Linux kernel patch that adds a NULL check after skb_clone() in send_mcast_pkt(). Update to a patched kernel version if available. Monitor kernel logs for related errors as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-63991. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70