CVE-2026-45836: Linux Kernel Bluetooth L2CAP Vulnerability

CVE-2026-45836 Overview

CVE-2026-45836 is a null pointer dereference vulnerability in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) implementation. The flaw resides in the l2cap_sock_get_sndtimeo_cb() callback, which lacked the NULL guard already present in sibling callbacks l2cap_sock_resume_cb() and l2cap_sock_ready_cb(). When the callback is invoked against an L2CAP socket whose associated structure has been torn down or not yet fully initialized, the kernel dereferences a NULL pointer and triggers a kernel oops.

Critical Impact
Triggering the unchecked dereference results in a kernel crash, producing a local denial-of-service condition on affected Linux systems with Bluetooth enabled.

Affected Products

Linux kernel versions containing the l2cap_sock_get_sndtimeo_cb() implementation without the NULL guard
Distributions shipping vulnerable upstream kernels with Bluetooth L2CAP support enabled
Systems exposing Bluetooth sockets to local users via AF_BLUETOOTH

Discovery Timeline

2026-05-26 - CVE-2026-45836 published to the National Vulnerability Database
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-45836

Vulnerability Analysis

The Linux kernel Bluetooth subsystem registers a set of channel operation callbacks used by the L2CAP socket layer to interact with channel state. The l2cap_sock_get_sndtimeo_cb() function returns the send timeout associated with the socket backing an L2CAP channel. The function accessed the socket pointer derived from the channel without first verifying that the pointer was non-NULL.

Sibling callbacks in the same operations vector, l2cap_sock_resume_cb() and l2cap_sock_ready_cb(), already performed this NULL check. The fix introduces the same defensive guard in l2cap_sock_get_sndtimeo_cb(), aligning the callback set and preventing the dereference during transitional states where the socket reference is absent.

Root Cause

The root cause is a missing NULL check on the channel-to-socket pointer used inside l2cap_sock_get_sndtimeo_cb(). Under specific timing or teardown conditions the callback can be invoked while the associated socket pointer is NULL, producing a kernel null pointer dereference [CWE-476]. The remediation mirrors the pre-existing guard pattern used elsewhere in net/bluetooth/l2cap_sock.c.

Attack Vector

The attack surface is local. A user with the ability to create and manipulate Bluetooth L2CAP sockets, or to influence the lifecycle of an L2CAP channel, can drive the kernel through code paths that invoke l2cap_sock_get_sndtimeo_cb() against a channel whose socket pointer is not set. The resulting dereference crashes the kernel and forces a reboot, denying service to all users on the host.

No verified public exploit code is available for this issue. See the upstream Linux kernel commits for technical details: Commit 32bd343, Commit 58dc5e3, Commit 78a88d4, Commit a93d669, and Commit cf1fd51.

Detection Methods for CVE-2026-45836

Indicators of Compromise

Unexpected kernel oops or panic entries in dmesg or /var/log/kern.log referencing l2cap_sock_get_sndtimeo_cb or net/bluetooth/l2cap_sock.c
Repeated host reboots correlated with local Bluetooth activity or process creation of Bluetooth-aware binaries
Crash traces containing BUG: kernel NULL pointer dereference with a call stack passing through the L2CAP socket operations vector

Detection Strategies

Inventory running kernel versions across the fleet and flag hosts running pre-patch versions in uname -r output
Monitor kernel ring buffer messages for null pointer dereferences originating in the Bluetooth subsystem
Audit local processes invoking socket(AF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP) on systems where Bluetooth is not required

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on l2cap_sock_* symbols in crash traces
Track host reboot counts and uptime regressions on workstations and laptops with Bluetooth hardware
Correlate process telemetry for unprivileged processes opening Bluetooth sockets shortly before kernel crashes

How to Mitigate CVE-2026-45836

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry and rebuild or update affected kernels
Update to a distribution kernel package that includes the NULL guard in l2cap_sock_get_sndtimeo_cb()
Reboot hosts after kernel updates to load the patched image

Patch Information

The fix adds the missing NULL guard to l2cap_sock_get_sndtimeo_cb() so the callback returns safely when the socket pointer is absent. Patched kernels are available via the stable tree commits 32bd343, 58dc5e3, 78a88d4, a93d669, and cf1fd51. Apply the patched package shipped by your Linux distribution maintainer.

Workarounds

Disable the Bluetooth stack on hosts that do not require it by stopping and masking the bluetooth.service unit
Blacklist the bluetooth and btusb kernel modules to prevent loading on systems without a Bluetooth use case
Restrict creation of AF_BLUETOOTH sockets through seccomp profiles on multi-user systems

bash

# Disable and prevent loading of the Bluetooth stack until patched kernels are deployed
sudo systemctl stop bluetooth.service
sudo systemctl mask bluetooth.service
echo 'install bluetooth /bin/true' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'install btusb /bin/true' | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo rmmod btusb bluetooth 2>/dev/null || true