A null pointer dereference in the Bluetooth L2CAP layer of the Linux kernel can cause the operating system to crash when a socket’s state changes. The vulnerable callback l2cap_sock_state_change_cb() lacked a null guard that is present in similar callbacks, and when triggered the kernel panics, resulting in a denial of service for the host.

The flaw exists in all Linux kernel releases prior to commit 1810e42ff6716f320c7269d5850eca48b07b7427. Any system running an unpatched kernel with the Bluetooth L2CAP interface enabled is susceptible. The change is specific to the kernel’s Bluetooth implementation and does not affect user‑space applications directly.

The EPSS score is <1% and the flaw is not listed in CISA KEV, indicating no current documented exploitation. The CVSS score is 5.5. However, a kernel crash is a severe impact, and the bug can be triggered by sending crafted Bluetooth traffic that causes a socket state transition. Attackers would need the ability to interact with the Bluetooth subsystem, which could be local or potentially remote if the system exposes Bluetooth services. Because the flaw arises from a missing null guard, it cannot be exploited for code execution or privilege escalation based on the current description.