Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth component that could cause a system crash. The issue occurs when the system attempts to update the status of a Bluetooth connection but finds missing data, leading to a 'null pointer dereference.' This primarily impacts system stability and availability, potentially allowing a local user or a nearby Bluetooth device to trigger a kernel panic.
Technical details
A null pointer dereference vulnerability existed in the 'l2cap_sock_state_change_cb' function within 'net/bluetooth/l2cap_sock.c'. The root cause was a missing NULL check for the 'sk' (socket) pointer derived from 'chan->data' before accessing 'sk->sk_state'. This vulnerability could be triggered during Bluetooth L2CAP state transitions if the associated socket data was already cleared or not yet initialized. The fix introduces a NULL guard consistent with other L2CAP callback functions. Patches have been backported to multiple stable kernel branches.
Affected products
- Linux Linux kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-15: other: Patch authored
- 2026-05-26: disclosed: CVE published
- 2026-05-26: patched: Patches integrated into stable trees
References
- https://git.kernel.org/stable/c/1810e42ff6716f320c7269d5850eca48b07b7427
- https://git.kernel.org/stable/c/2ff1a41a912de8517b4482e946dd951b7d80edbf
- https://git.kernel.org/stable/c/5105f3e6b2df619c635b5f6a49fac131a36c7952
- https://git.kernel.org/stable/c/a2dcf1a61d056aef15b63c6eae9441344d624389
- https://git.kernel.org/stable/c/c88c185ae0a1067823661b220aeea613df2c127b