Skip to main content

Linux Kernel CVE-2026-45834

| EUVDEUVD-2026-31856 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-26 Linux GHSA-9xj3-pxmc-gv6m
Linux Denial Of Service Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only attack vector requiring low-privilege credentials; sole impact is kernel crash (availability), with no confidentiality or integrity effect and no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 26, 2026 - 21:27 vuln.today
CVSS changed
Jun 26, 2026 - 19:07 NVD
5.5 (MEDIUM)
Patch available
May 26, 2026 - 18:02 EUVD
CVE Published
May 26, 2026 - 16:14 nvd
MEDIUM 5.5
CVE Published
May 26, 2026 - 16:14 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()

Add the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb().

AnalysisAI

NULL pointer dereference in the Linux kernel Bluetooth L2CAP subsystem causes a local denial-of-service via kernel panic when l2cap_sock_state_change_cb() is invoked with a NULL socket pointer. A local low-privileged user with access to the Bluetooth socket API can trigger a system crash by exercising the L2CAP state change callback path that lacked the NULL guard already applied to sibling callbacks l2cap_sock_resume_cb() and l2cap_sock_ready_cb(). No active exploitation is confirmed (not in CISA KEV) and EPSS stands at 0.02% (5th percentile), indicating minimal real-world adversarial interest at time of analysis.

Technical ContextAI

The affected code resides in the Linux kernel Bluetooth stack, within the L2CAP (Logical Link Control and Adaptation Protocol) socket layer. L2CAP is a foundational Bluetooth protocol providing channel multiplexing, segmentation, and reassembly for higher-layer protocols. The vulnerability (CWE-476, NULL Pointer Dereference) exists in l2cap_sock_state_change_cb(), a callback triggered when an L2CAP connection changes state. Unlike the functionally related callbacks l2cap_sock_resume_cb() and l2cap_sock_ready_cb() - which already include NULL guards to protect against a missing socket context - this callback lacked the equivalent check. When the callback fires in a code path where the socket pointer is NULL, the kernel unconditionally dereferences it, producing an oops or kernel panic. The fix, backported across multiple stable branches, adds the same NULL guard idiom already established elsewhere in the same subsystem. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* from introducing commit 89bc500e41fc5b48e0573e6b0d927fc97b8951dc forward.

RemediationAI

Apply the vendor-released patches immediately for the relevant stable branch: upgrade to Linux 6.6.140, 6.12.88, 6.18.30, 7.0.7, or 7.1-rc3. Individual fix commits are available at git.kernel.org - key references include 5105f3e6b2df619c635b5f6a49fac131a36c7952, c88c185ae0a1067823661b220aeea613df2c127b, 1810e42ff6716f320c7269d5850eca48b07b7427, a2dcf1a61d056aef15b63c6eae9441344d624389, and 2ff1a41a912de8517b4482e946dd951b7d80edbf, plus additional commits referenced from NVD (0c17c8832562b2aac288e89cefd0f46074f54bcb, 1b1c0da227bf63479bac9982fc8d12df9aaea0fb, 85426e97dc72f2088ba6d27e74cd58c3fbd43e31). If patching is not immediately feasible, disable the Bluetooth subsystem via modprobe -r btusb or blacklisting relevant modules in /etc/modprobe.d/ - this eliminates all Bluetooth functionality as a trade-off. Alternatively, enforce MAC policy (SELinux or AppArmor) to restrict unprivileged users from accessing Bluetooth sockets, reducing exposure without a full stack disable. On systems where Bluetooth is not required operationally, disabling it is a zero-cost hardening measure independent of this CVE.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2026-45834 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy