CVE-2026-45835: Linux Kernel Bluetooth L2CAP Vulnerability

CVE-2026-45835 Overview

CVE-2026-45835 is a null pointer dereference vulnerability in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) subsystem. The flaw resides in the l2cap_sock_new_connection_cb() callback function, which previously lacked a NULL guard that is already present in the sibling callbacks l2cap_sock_resume_cb() and l2cap_sock_ready_cb(). When the parent socket is unexpectedly NULL during a new L2CAP connection event, the kernel dereferences an invalid pointer. The result is a kernel oops or panic, leading to denial of service on affected systems.

Critical Impact
A reachable null pointer dereference in the Linux kernel Bluetooth L2CAP path can cause a kernel crash, resulting in local denial of service on systems with Bluetooth enabled.

Affected Products

Linux kernel (mainline) — Bluetooth L2CAP subsystem
Linux stable trees receiving the fix commits referenced in git.kernel.org
Distributions shipping vulnerable kernels with Bluetooth support enabled

Discovery Timeline

2026-05-26 - CVE-2026-45835 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-45835

Vulnerability Analysis

The Linux kernel Bluetooth stack uses a set of socket callback functions to handle L2CAP connection state changes. Three related callbacks exist: l2cap_sock_resume_cb(), l2cap_sock_ready_cb(), and l2cap_sock_new_connection_cb(). The first two callbacks include a NULL check before dereferencing the socket pointer associated with the L2CAP channel. The l2cap_sock_new_connection_cb() callback omitted this guard. When the function is invoked with a channel whose backing socket has been torn down or never fully initialized, the kernel attempts to operate on a NULL pointer.

Root Cause

The defect is a missing input validation check in a kernel callback. The fix, distributed across multiple stable branches, adds the same NULL guard already present in the two sibling callbacks. This is consistent with a Null Pointer Dereference weakness pattern. No memory corruption occurs, but execution flow reaches an instruction that dereferences an unmapped address in kernel space.

Attack Vector

Triggering the vulnerability requires interaction with the local Bluetooth stack to drive the L2CAP connection state machine into the racy or unexpected condition. An attacker with access to issue Bluetooth operations on the host, or a paired remote peer driving connection events, can produce the NULL parent socket condition. Successful exploitation crashes the kernel and causes denial of service. The published metadata does not indicate that arbitrary code execution or privilege escalation is achievable from this dereference alone.

No verified public proof-of-concept code is available. Patch details for each stable branch are tracked in the kernel git commits, including 0a120d96, 741e6024, 76083fb8, ab77c8bc, and bc3bb9f4. See the kernel.org stable commit log for the canonical fix.

Detection Methods for CVE-2026-45835

Indicators of Compromise

Kernel oops or panic messages referencing l2cap_sock_new_connection_cb in dmesg or /var/log/kern.log.
Unexpected Bluetooth service restarts or bluetoothd reconnects coinciding with kernel stack traces.
Repeated short-lived L2CAP connection attempts from an unfamiliar Bluetooth peer prior to a crash.

Detection Strategies

Monitor kernel logs for null pointer dereference signatures within the net/bluetooth/l2cap_sock.c call path.
Correlate host reboots and kernel crashes with Bluetooth subsystem events using centralized log ingestion.
Track installed kernel package versions across the fleet and flag hosts running pre-patch builds with Bluetooth enabled.

Monitoring Recommendations

Forward kernel, bluetoothd, and systemd journal entries to a central logging or SIEM platform for crash pattern analysis.
Alert on BUG: kernel NULL pointer dereference strings followed by an L2CAP-related symbol in the stack trace.
Inventory Bluetooth-capable Linux endpoints and prioritize them for patch verification.

How to Mitigate CVE-2026-45835

Immediate Actions Required

Apply the upstream Linux kernel patches that add the NULL guard to l2cap_sock_new_connection_cb() across mainline and stable trees.
Update to distribution kernel packages that include the referenced fix commits and reboot affected hosts.
On systems that do not require Bluetooth, disable the Bluetooth service and blacklist the bluetooth and btusb kernel modules.

Patch Information

The fix is committed to the Linux stable trees through commits 0a120d96166301d7a95be75b52f843837dbd1219, 741e6024e31587b0c021b6616a9e428a4ea0b64a, 76083fb80f5a38ac13326b2d810f66bd07771eea, ab77c8bc30269bee15d917059a66bea48909f5f0, and bc3bb9f40da8e53896abc2d29c6d0c6686fe4ab9. Refer to the Linux kernel stable commit reference and consume the corresponding distribution kernel update once available.

Workarounds

Disable Bluetooth on hosts that do not require it using systemctl disable --now bluetooth.service.
Unload and blacklist the bluetooth kernel module on servers and workstations with no Bluetooth use case.
Restrict physical and wireless proximity to untrusted Bluetooth peers on systems that cannot be patched immediately.

bash

# Configuration example: disable Bluetooth stack on systems that do not need it
sudo systemctl disable --now bluetooth.service
echo "blacklist bluetooth" | sudo tee /etc/modprobe.d/blacklist-bluetooth.conf
echo "blacklist btusb" | sudo tee -a /etc/modprobe.d/blacklist-bluetooth.conf
sudo update-initramfs -u