Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth component that could cause a system crash. The issue occurs when the system attempts to access Bluetooth socket information that is no longer available, leading to a 'null pointer dereference.' This could potentially be used by a local attacker to cause a denial-of-service (system crash), impacting the availability of the affected device.
Technical details
A null pointer dereference vulnerability exists in the Linux kernel's Bluetooth L2CAP implementation within the 'net/bluetooth/l2cap_sock.c' file. The function 'l2cap_sock_get_sndtimeo_cb' fails to validate if the 'chan->data' (the associated socket) is NULL before attempting to read 'sk_sndtimeo'. This lack of a NULL guard can be triggered during certain Bluetooth socket operations, resulting in a kernel panic. The fix involves adding a NULL check to ensure the socket structure exists before it is accessed, consistent with other callback functions in the same module. Patches have been merged into multiple stable kernel branches.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026
Timeline
- 2026-04-15: other: Vulnerability fixed in source code by Siwei Zhang
- 2026-05-26: advisory: CVE-2026-45836 published by NVD
References
- https://git.kernel.org/stable/c/32bd343803d4ba47cc516f9d5f037f01b855d767
- https://git.kernel.org/stable/c/58dc5e3d8768e121907608e6e196a908512fb083
- https://git.kernel.org/stable/c/78a88d43dab8d23aeef934ed8ce34d40e6b3d613
- https://git.kernel.org/stable/c/a93d66907dd4d29b65c9797a93784bf61906d6d6
- https://git.kernel.org/stable/c/cf1fd517f892ded88168df878f834b625133f86d