CVE-2026-45836

What it actually does

This vulnerability is a NULL pointer dereference in the Linux kernel Bluetooth L2CAP socket handling path, specifically in l2cap_sock_get_sndtimeo_cb(). A local, low-privileged user can trigger a code path where the kernel callback dereferences an unset pointer, causing a kernel oops or panic depending on system configuration. The expected impact is denial of service through loss of system availability; there is no indication from the provided data that the flaw enables privilege escalation, data disclosure, or data modification.

Why it matters to the business

Successful exploitation can crash or destabilize affected Linux systems that include the vulnerable Bluetooth L2CAP kernel code, potentially interrupting user endpoints, embedded devices, kiosks, appliances, or servers with Bluetooth support enabled. The CVSS score indicates a moderate-severity issue with high availability impact, but exploitation requires local access and there is currently no known public exploit maturity, KEV listing, or ransomware association, lowering immediate mass-exploitation risk. Organizations with large Linux fleets, laptops, edge devices, or products that ship Bluetooth-enabled kernels may still face operational disruption if untrusted local users or sandbox escapes can reach the vulnerable interface.

How an attack unfolds

An attacker first needs local code execution with low privileges on a vulnerable Linux system. They then interact with the Bluetooth L2CAP socket interface in a way that reaches the affected send-timeout callback. Because l2cap_sock_get_sndtimeo_cb() lacks the NULL guard used by related callbacks, the crafted sequence can cause the kernel to dereference a NULL pointer. This results in a kernel oops and, depending on kernel panic settings and service supervision, may crash the host, force a reboot, terminate workloads, or leave Bluetooth/network-related functionality unstable. The attack is most relevant where untrusted local users, containers with excessive device/socket access, or endpoint malware can access Bluetooth kernel functionality.

How to fix it

Apply a Linux kernel update from the operating system, distribution, device vendor, or kernel maintainer that includes the upstream fix adding the missing NULL guard in l2cap_sock_get_sndtimeo_cb(). No exact fixed package versions were provided, so remediation should be tracked through vendor advisories and kernel changelogs for CVE-2026-45836 or the Bluetooth L2CAP NULL pointer dereference fix. Where immediate patching is not possible, reduce exposure by disabling Bluetooth if not required, preventing untrusted users from accessing Bluetooth functionality, restricting container/device access to Bluetooth sockets and devices, and applying standard local-hardening controls. Reboot systems after kernel updates to ensure the fixed kernel is running.

How to confirm the fix worked

Confirm exposure by checking the running kernel version against the relevant distribution or vendor advisory for this Bluetooth L2CAP fix, not just the installed package version. Validate remediation by confirming the host has booted into a fixed kernel after patching. Where Bluetooth is not required, verify it is disabled or blocked through service configuration, kernel module policy, or platform controls. Review whether untrusted local users, containers, sandboxes, or applications can access Bluetooth sockets or devices. For Linux systems, useful checks include reviewing the running kernel with uname -a, installed kernel packages through the platform package manager, loaded Bluetooth modules such as bluetooth and l2cap, and system logs for prior NULL pointer dereference events involving l2cap_sock_get_sndtimeo_cb().

Typical attack path

1. Obtain local execution on an affected Linux system with low privileges.
2. Confirm that the running kernel includes vulnerable Bluetooth L2CAP code and that Bluetooth-related kernel functionality is available.
3. Create or manipulate Bluetooth L2CAP sockets to reach the vulnerable callback path.
4. Trigger the missing NULL-check condition in l2cap_sock_get_sndtimeo_cb().
5. Cause a kernel NULL pointer dereference, leading to a kernel oops, panic, reboot, or service disruption.

How to detect it

To determine whether this was already exploited, review kernel and system logs for crashes or oops events involving Bluetooth L2CAP code. Relevant log sources include journalctl output, /var/log/kern.log, /var/log/messages, /var/log/syslog, crash dump tooling such as kdump/vmcore records, endpoint telemetry that captures kernel panics, and system reboot history. Look for NULL pointer dereference messages, call traces naming l2cap_sock_get_sndtimeo_cb(), Bluetooth socket callbacks, L2CAP functions, unexplained reboots, or repeated kernel oops events shortly after local user activity involving Bluetooth. Because this is a denial-of-service flaw, durable artifacts may be limited to kernel logs, crash dumps, panic records, and uptime/reboot evidence. There are no network-only indicators expected for reliable detection because exploitation is local.

• l2cap_sock_get_sndtimeo_cb
• BUG: kernel NULL pointer dereference
• Oops: 0000
• kernel NULL pointer dereference
• Call Trace:
• Bluetooth: L2CAP
• l2cap_sock_resume_cb
• l2cap_sock_ready_cb
• AF_BLUETOOTH
• BTPROTO_L2CAP
• /var/log/kern.log
• /var/log/messages
• /var/log/syslog
• /var/crash/
• /proc/vmcore
• Kernel panic - not syncing

What your security team should do

• Prioritize patching Linux endpoints, embedded systems, and shared multi-user systems where Bluetooth is enabled or local user access is broadly available.
• Track vendor advisories for exact fixed kernel package versions and ensure systems are rebooted into the corrected kernel after installation.
• Disable Bluetooth on systems that do not require it, especially servers, appliances, and production workloads.
• Restrict container, sandbox, and untrusted workload access to Bluetooth devices, AF_BLUETOOTH sockets, and related host capabilities.
• Hunt historical kernel logs for NULL pointer dereferences, oops, or panic messages referencing l2cap_sock_get_sndtimeo_cb, L2CAP, or Bluetooth socket callbacks.
• Monitor for repeated local crash patterns that may indicate denial-of-service attempts, even though there is currently no known KEV listing, ransomware use, or mature public exploit.