Skip to main content

Linux Kernel EUVDEUVD-2026-31857

| CVE-2026-45835 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-26 Linux GHSA-qjjp-q69m-v8xm
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges required to invoke Bluetooth L2CAP callbacks; impact is kernel crash only, with no confidentiality or integrity exposure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 26, 2026 - 21:27 vuln.today
CVSS changed
Jun 26, 2026 - 19:07 NVD
5.5 (MEDIUM)
Patch available
May 26, 2026 - 18:02 EUVD
CVE Published
May 26, 2026 - 16:14 nvd
UNKNOWN (no severity yet)
CVE Published
May 26, 2026 - 16:14 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()

Add the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb().

AnalysisAI

Null pointer dereference in the Linux kernel's Bluetooth L2CAP socket layer crashes the kernel when l2cap_sock_new_connection_cb() is invoked without the NULL guard present in sibling callbacks. Local unprivileged users on systems with Bluetooth enabled can trigger a kernel oops or panic, resulting in a denial of service. No public exploit or CISA KEV listing exists; EPSS probability is near zero at 0.02% (5th percentile), indicating minimal active exploitation interest at time of analysis.

Technical ContextAI

The vulnerability resides in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) socket layer - the core multiplexing protocol underpinning most Bluetooth connection profiles. The affected function l2cap_sock_new_connection_cb() is a callback invoked when a new L2CAP connection is established, and it lacks the NULL pointer check that sibling callbacks l2cap_sock_resume_cb() and l2cap_sock_ready_cb() already carry. CWE-476 (NULL Pointer Dereference) identifies the root cause: the code dereferences a pointer without validating it is non-NULL, triggering a kernel exception. CPE data confirms all Linux kernel versions across affected stable branches are impacted until the respective backported fix commits. The subsystem requires CONFIG_BT_L2CAP to be compiled in and the Bluetooth hardware and module to be active.

RemediationAI

The primary fix is to upgrade to a patched kernel version: Linux 6.6.140 or later for the 6.6.x stable branch, 6.12.88 or later for 6.12.x, 6.18.30 or later for 6.18.x, 7.0.7 or later for 7.0.x, or 7.1-rc3 or later for 7.1.x. Distributions will backport these via their own security channels (Ubuntu USN, RHEL RHSA, Debian DSA); apply distribution-provided kernel updates as available. If immediate patching is not feasible and Bluetooth is not operationally required, disable the Bluetooth subsystem with systemctl disable --now bluetooth && rmmod btusb - this eliminates the attack surface entirely with no functional trade-off for non-Bluetooth workloads. On systems requiring Bluetooth, restrict L2CAP socket creation by untrusted users using AppArmor or SELinux policies limiting AF_BLUETOOTH socket access to specific trusted processes; note this may break unprivileged Bluetooth applications and requires policy tuning per deployment.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES12-SP5-Azure-BYOS Affected
Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-EC2-SAP-On-Demand Affected
SUSE Linux Enterprise Server 12 SP5-LTSS Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Fixed
openSUSE Tumbleweed Fixed

Share

EUVD-2026-31857 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy