EUVD-2026-45564
GHSA-5hvm-w645-g9wh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged access
-
DeliveryUse active Bluetooth 6LoWPAN interface
-
ExploitSend multicast traffic during memory pressure
-
Executionskb_clone() fails returning NULL
-
ImpactNULL deref in send_pkt() crashes kernel
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Bluetooth 6LoWPAN subsystem (net/bluetooth/6lowpan, CONFIG_BT_6LOWPAN) to be compiled in and active with at least one connected peer, so that send_mcast_pkt() is exercised during multicast transmission. The NULL pointer dereference only manifests when skb_clone() fails - i.e. under kernel memory allocation failure/memory pressure - which is not directly attacker-controlled and is the primary limiting factor on exploitability. Per the CVSS vector (AV:L/PR:L) exploitation is local and requires low-privilege access, not remote or unauthenticated; impact is limited to availability (kernel crash), with no confidentiality or integrity effect. Systems without Bluetooth 6LoWPAN enabled are not affected. |
| Impact | This is a low-priority, high-CVSS-does-not-apply-here case. The signals are mutually consistent and all point low: CVSS 3.1 base is 5.5 (MEDIUM) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - purely an availability impact reachable only from a local, authenticated (PR:L) context, with no confidentiality or integrity effect. EPSS is 0.18% (7th percentile), the CVE is NOT in CISA KEV, and no public exploit was identified in the provided data, so there is no evidence of active or likely exploitation. Critically, the root cause is a missing NULL check after skb_clone() in send_mcast_pkt(); the NULL only occurs when a kernel memory allocation fails (OOM/memory pressure). An attacker cannot reliably force skb_clone() to fail on demand, so in practice this behaves more like a robustness/reliability defect triggered under memory exhaustion than a dependably weaponizable DoS. There is no SSVC decision data in the input to cross-reference. Net: a real but minor hardening fix, not an operational emergency; the only caveat is that the local low-privilege attacker must also be using the Bluetooth 6LoWPAN path, which is uncommon. |
| Exploit ScenarioDerived | A local, low-privileged user on a system that has the Bluetooth 6LoWPAN (BT_6LOWPAN) feature active drives multicast traffic over the 6lowpan interface while the system is under memory pressure. If skb_clone() returns NULL during fan-out in send_mcast_pkt(), send_pkt() dereferences skb->data and triggers a NULL pointer dereference, crashing the kernel (denial of service). No public exploit code is identified, and reliable triggering depends on inducing an allocation failure, which is not directly attacker-controlled. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A NULL pointer dereference in the Linux kernel's Bluetooth 6LoWPAN transmit path allows a local user with low privileges to crash the kernel when memory allocation pressure causes skb_clone() to fail inside send_mcast_pkt(). Only systems with the Bluetooth 6LoWPAN subsystem compiled in and actively transmitting multicast packets to a connected peer are affected; the impact is limited to availability (denial of service via kernel crash), with no confidentiality or integrity effect. Exploitation is gated by a non-attacker-controlled precondition (allocation failure), EPSS is negligible at 0.18% (7th percentile), and no public exploit code has been identified at time of analysis, though vendor patches have been released across multiple stable branches.
RemediationAI
Vendor-released patches are available: upgrade to Linux 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35 or 7.0.12 (or the corresponding upstream fix commits listed above), or apply the distribution kernel update from your vendor - for Ubuntu see USN-8593-1 at https://ubuntu.com/security/notices/USN-8593-1, and general details at https://nvd.nist.gov/vuln/detail/CVE-2026-63991 and https://seclists.org/oss-sec/2026/q3/230. Because the fault only triggers when skb_clone() fails, patch priority is low relative to its nominal CVSS; nevertheless it is a trivial, low-risk kernel update. If patching must be deferred, the only effective compensating control is to remove the vulnerable code path entirely by building the kernel without CONFIG_BT_6LOWPAN, or by disabling/blocking the Bluetooth 6LoWPAN interface (e.g. powering down the Bluetooth adapter or refusing 6LoWPAN/L2CAP connection setup) so send_mcast_pkt() is never reached - the trade-off being complete loss of IPv6-over-Bluetooth mesh functionality on that host. Generic hardening such as memory-pressure tuning is not a reliable substitute, since allocation failure is the precondition rather than the attack vector itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in net/bluetooth/6lowpan, the kernel subsystem that carries IPv6 6LoWPAN traffic over Bluetooth Low Energy L2CAP connections (CONFIG_BT_6LOWPAN). The function send_mcast_pkt() builds per-peer copies of multicast frames via skb_clone() before handing them to send_pkt() for transmission; skb_clone() can return NULL when the kernel cannot allocate the socket-buffer metadata. The original code dereferenced the returned clone without a NULL check, so a failed allocation propagated a NULL skb into send_pkt(), which dereferences skb->data and faults in kernel context. This is CWE-476 (NULL Pointer Dereference), a classic unchecked-return defect: the root cause is a missing error path rather than a memory-safety corruption, which is why the assessed CVSS vector raises AC to High and confines impact to availability. The fixed code adds a NULL check and simply skips the affected peer, so multicast delivery to other peers continues. Affected code is present in Linux mainline and all stable branches carrying this subsystem, identified by the CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.
Know when Bluetooth gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local low-priv access (AV:L/PR:L) to the 6lowpan path; AC:H because the crash requires a transient memory-allocation failure the attacker cannot reliably induce; availability-only impact (A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
The skb_clone() function can return NULL if memory allocation fails. send_mcast_pkt() calls skb_clone() without checking the return value, which can lead to a NULL pointer dereference in send_pkt() when it dereferences skb->data. Add a NULL check after skb_clone() and skip the peer if the clone fails.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated Bluetooth Low Energy OTA firmware upgrade in the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware
CVE-2025-32879 is a security vulnerability (CVSS 8.8) that allows an attacker. Risk factors: public PoC available.
Zephyr's Bluetooth Low Energy connection-response handler fails to verify that a connection request was actually initiat
Heap OOB write in Android Bluetooth driver via incorrect bounds check.
A use-after-free in the Android Bluetooth stack (bluetooth_ccc.cc, function BluetoothCccHandlerCallbackImpl) lets an att
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may
Memory corruption in the Zephyr RTOS LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) lets an attac
A memory leak combined with a use-after-free in the Linux kernel's Bluetooth HCI connection-setup path can crash the ker
A race condition in the Linux kernel's Bluetooth L2CAP subsystem allows a use-after-free of the hci_conn::l2cap_data poi
Bluetooth authentication bypass in SwitchBot Door Lock Series allows an attacker within BLE range to manipulate the lock
Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into usersp
A stack-based buffer overflow in the vCard parser of the Alpine iLX-F511 in-dash multimedia receiver (build 7.0.0000) le
Exploit-DB