A coding oversight in Linux’s Bluetooth 6lowpan driver lets the skb_clone() function return NULL when memory allocation fails. send_mcast_pkt() does not check this return value and, if NULL, subsequently dereferences skb->data in send_pkt(), causing a kernel crash. The flaw is a classic null pointer dereference (CWE‑476). The effect is a system crash, which leads to a denial of service.

All Linux kernel releases containing the unpatched Bluetooth 6lowpan subsystem are affected. The vulnerability exists in the kernel’s networking stack handling multicast packets over Bluetooth 6lowpan. Any distribution that has not incorporated the recent patched commits is at risk.

The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 5.5 reflects medium severity, matching the potential to cause a system crash leading to denial of service. The likely attack vector involves sending a crafted Bluetooth 6lowpan multicast packet to the target; this inference is based on the description that the fault is triggered by a multicast packet; it is not explicitly stated that the attack is remote, but the use of Bluetooth implies a proximity or wireless remote vector. No public exploit is documented. The risk remains moderate: significant impact if exploited but low likelihood of successful exploitation. Patching is advised over monitoring alone.