Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth component that could cause a system crash. The issue occurs when the system handles new Bluetooth connections and encounters unexpected empty data, leading to a 'null pointer dereference.' This could potentially be used by an attacker in close physical proximity to disrupt the availability of affected devices.
Technical details
A null pointer dereference vulnerability exists in the Linux kernel Bluetooth L2CAP protocol implementation. The flaw is located in the 'l2cap_sock_new_connection_cb' function within 'net/bluetooth/l2cap_sock.c'. The root cause is a lack of a NULL check for the 'parent' socket pointer retrieved from 'chan->data' before it is passed to 'lock_sock()'. An attacker within Bluetooth range could potentially trigger this condition during connection establishment, resulting in a Denial of Service (DoS) via kernel panic. The issue has been resolved by adding a NULL guard similar to those existing in other L2CAP callback functions.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-15: other: Patch authored
- 2026-05-26: advisory: CVE published by NVD
- 2026-05-26: patched: Fixes merged into various stable kernel branches
References
- https://git.kernel.org/stable/c/0a120d96166301d7a95be75b52f843837dbd1219
- https://git.kernel.org/stable/c/741e6024e31587b0c021b6616a9e428a4ea0b64a
- https://git.kernel.org/stable/c/76083fb80f5a38ac13326b2d810f66bd07771eea
- https://git.kernel.org/stable/c/ab77c8bc30269bee15d917059a66bea48909f5f0
- https://git.kernel.org/stable/c/bc3bb9f40da8e53896abc2d29c6d0c6686fe4ab9