CVE-2026-45836 - Vulnerability Details

- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()

Add the same NULL guard already present in
l2cap_sock_resume_cb() and l2cap_sock_ready_cb().

Published: 2026-05-26

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A null pointer dereference exists in the function that retrieves the Bluetooth L2CAP socket send timeout. When this function is invoked with a null or unexpected pointer, the kernel will crash, resulting in a denial of service. The bug is a classic example of a null pointer dereference and does not provide an attack vector for code execution.

Affected Systems

All Linux kernel builds that include the Bluetooth L2CAP stack and have not yet integrated the patch that adds a NULL guard to l2cap_sock_get_sndtimeo_cb(). This encompasses any distribution using the standard Linux kernel Bluetooth implementation.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate severity. The EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no known exploits in the wild. Based on the description, it is inferred that the flaw can be triggered by malformed Bluetooth packets attempting to invoke the send timeout function; however, the actual likelihood of exploitation remains low given the available metrics.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8d836d71e2223b8961b21112bb4ce89ef8231682`	affected	< fd072f833147b0bc10c43a454624cb99d02f3fc7
`8d836d71e2223b8961b21112bb4ce89ef8231682`	affected	< 6e8d1a2a677a81caa60cf0aabd4217bd585fbba1
`8d836d71e2223b8961b21112bb4ce89ef8231682`	affected	< e1863e7480feddb90125d0dd5a1b572972d75908
`8d836d71e2223b8961b21112bb4ce89ef8231682`	affected	< cf1fd517f892ded88168df878f834b625133f86d
`8d836d71e2223b8961b21112bb4ce89ef8231682`	affected	< 58dc5e3d8768e121907608e6e196a908512fb083
`8d836d71e2223b8961b21112bb4ce89ef8231682`	affected	< 32bd343803d4ba47cc516f9d5f037f01b855d767
`8d836d71e2223b8961b21112bb4ce89ef8231682`	affected	< a93d66907dd4d29b65c9797a93784bf61906d6d6
`8d836d71e2223b8961b21112bb4ce89ef8231682`	affected	< 78a88d43dab8d23aeef934ed8ce34d40e6b3d613

Linux

affected

Version	Status	Constraints
`3.13`	affected	—
`0`	unaffected	< 3.13
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.140`	unaffected	≤ 6.6.*
`6.12.90`	unaffected	≤ 6.12.*
`6.18.30`	unaffected	≤ 6.18.*
`7.0.7`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8d836d71e2223b8961b21112bb4ce89ef8231682,cf1fd517f892ded88168df878f834b625133f86d)`	affected	code_commit	—
`[8d836d71e2223b8961b21112bb4ce89ef8231682,58dc5e3d8768e121907608e6e196a908512fb083)`	affected	code_commit	—
`[8d836d71e2223b8961b21112bb4ce89ef8231682,32bd343803d4ba47cc516f9d5f037f01b855d767)`	affected	code_commit	—
`[8d836d71e2223b8961b21112bb4ce89ef8231682,a93d66907dd4d29b65c9797a93784bf61906d6d6)`	affected	code_commit	—
`[8d836d71e2223b8961b21112bb4ce89ef8231682,78a88d43dab8d23aeef934ed8ce34d40e6b3d613)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.13`	affected	generic	—
`[0,3.13)`	unaffected	generic	—
`[6.6.140,6.7.0)`	unaffected	semver	—
`[6.12.90,6.13.0)`	unaffected	semver	—
`[6.18.30,6.19.0)`	unaffected	semver	—
`[7.0.7,7.1.0)`	unaffected	semver	—
`[7.1-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the patch adding the NULL guard to l2cap_sock_get_sndtimeo_cb().
Apply the patch manually from the upstream kernel source if a kernel update is not immediately available.
Disable or restrict the Bluetooth service until a patched kernel is deployed to mitigate exposure.

Generated by OpenCVE AI on May 28, 2026 at 02:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/32bd343803d4ba47cc516f9d5f037f01b855d767
https://git.kernel.org/stable/c/58dc5e3d8768e121907608e6e196a908512fb083
https://git.kernel.org/stable/c/6e8d1a2a677a81caa60cf0aabd4217bd585fbba1
https://git.kernel.org/stable/c/78a88d43dab8d23aeef934ed8ce34d40e6b3d613
https://git.kernel.org/stable/c/a93d66907dd4d29b65c9797a93784bf61906d6d6
https://git.kernel.org/stable/c/cf1fd517f892ded88168df878f834b625133f86d
https://git.kernel.org/stable/c/e1863e7480feddb90125d0dd5a1b572972d75908
https://git.kernel.org/stable/c/fd072f833147b0bc10c43a454624cb99d02f3fc7
https://lore.kernel.org/linux-cve-announce/2026052629-CVE-2026-45836-9f4d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-45836
https://www.cve.org/CVERecord?id=CVE-2026-45836

History

Mon, 01 Jun 2026 17:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/6e8d1a2a677a81caa60cf0aabd4217bd585fbba1 https://git.kernel.org/stable/c/e1863e7480feddb90125d0dd5a1b572972d75908 https://git.kernel.org/stable/c/fd072f833147b0bc10c43a454624cb99d02f3fc7

Thu, 28 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026052629-CVE-2026-45836-9f4d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-45836 https://www.cve.org/CVERecord?id=CVE-2026-45836
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Tue, 26 May 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Tue, 26 May 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Add the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb().
Title		Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/32bd343803d4ba47cc516f9d5f037f01b855d767 https://git.kernel.org/stable/c/58dc5e3d8768e121907608e6e196a908512fb083 https://git.kernel.org/stable/c/78a88d43dab8d23aeef934ed8ce34d40e6b3d613 https://git.kernel.org/stable/c/a93d66907dd4d29b65c9797a93784bf61906d6d6 https://git.kernel.org/stable/c/cf1fd517f892ded88168df878f834b625133f86d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-26T16:14:13.568Z

Updated: 2026-06-14T17:45:57.724Z

Reserved: 2026-05-13T15:03:33.077Z

Link: CVE-2026-45836

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-26T17:16:50.813

Modified: 2026-06-01T17:17:11.710

Link: CVE-2026-45836

Redhat

Severity : Moderate

Publid Date: 2026-05-26T00:00:00Z

Links: CVE-2026-45836 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-28T02:15:04Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object