CVE-2026-63991: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63991 Overview

CVE-2026-63991 is a NULL pointer dereference vulnerability in the Linux kernel's Bluetooth 6lowpan subsystem. The flaw resides in the send_mcast_pkt() function, which invokes skb_clone() without validating the returned pointer. When memory allocation fails, skb_clone() returns NULL, and the downstream send_pkt() function dereferences skb->data on that NULL pointer. This triggers a kernel crash and results in a denial-of-service condition. The vulnerability affects systems that use Bluetooth Low Energy (BLE) 6lowpan multicast packet transmission. Upstream maintainers have resolved the issue by adding a NULL check after skb_clone() and skipping any peer whose clone operation fails.

Critical Impact
A failed skb clone under memory pressure causes a kernel NULL pointer dereference, leading to a denial-of-service on affected Linux systems using Bluetooth 6lowpan.

Affected Products

Linux kernel (Bluetooth 6lowpan subsystem, net/bluetooth/6lowpan.c)
Distributions shipping vulnerable kernel versions prior to the referenced stable commits
Systems with CONFIG_BT_6LOWPAN enabled that transmit IPv6 multicast over BLE

Discovery Timeline

2026-07-19 - CVE-2026-63991 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63991

Vulnerability Analysis

The vulnerability exists in the IPv6-over-Bluetooth-Low-Energy (6lowpan) implementation within the Linux kernel. Function send_mcast_pkt() iterates over connected 6lowpan peers and clones the outgoing socket buffer for each recipient using skb_clone(). The kernel API for skb_clone() can return NULL under memory pressure or when the slab allocator cannot satisfy the request. The vulnerable code path passes this potentially NULL pointer directly to send_pkt(), which then accesses skb->data without validation. The resulting NULL pointer dereference triggers a kernel oops and destabilizes the system.

Root Cause

The root cause is missing return value validation after a memory-allocating function call. This is a classic NULL Pointer Dereference weakness [CWE-476]. The developer assumed skb_clone() would always succeed, violating the kernel's defensive coding guidelines for allocation routines. Under low-memory conditions or intentional memory pressure, the assumption fails and the kernel dereferences address zero.

Attack Vector

Exploitation requires a Bluetooth peer relationship with the target system and the ability to trigger multicast packet transmission while the kernel is under memory pressure. An adjacent attacker within Bluetooth range who can establish a 6lowpan connection can influence the code path. The vulnerability does not directly enable code execution; the security impact is limited to denial-of-service through kernel crash. No verified public exploit is available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

The fix, applied across multiple stable branches, introduces a NULL check immediately after the skb_clone() call. If cloning fails, the loop skips the affected peer rather than proceeding to send_pkt(). See the Linux Kernel Commit 3d5d81d and related backports for the precise patch.

Detection Methods for CVE-2026-63991

Indicators of Compromise

Kernel oops or panic messages referencing send_mcast_pkt or send_pkt in net/bluetooth/6lowpan.c
Unexpected system reboots or hangs on hosts with CONFIG_BT_6LOWPAN enabled
dmesg entries showing NULL pointer dereference stack traces originating from the Bluetooth stack

Detection Strategies

Inventory running kernel versions across Linux endpoints and compare against the fixed stable commits referenced in the advisory
Audit which systems load the bluetooth_6lowpan kernel module using lsmod and configuration management tooling
Monitor kernel logs centrally for crash signatures involving the 6lowpan subsystem

Monitoring Recommendations

Forward journald and dmesg output to a centralized log platform for correlation of kernel crash events
Alert on repeated kernel oops entries referencing Bluetooth modules, which may indicate exploitation attempts under memory pressure
Track Bluetooth pairing events on IoT gateways and edge devices where 6lowpan is commonly enabled

How to Mitigate CVE-2026-63991

Immediate Actions Required

Apply the vendor kernel update that incorporates the upstream fix once your distribution publishes it
Disable the bluetooth_6lowpan module on systems that do not require IPv6-over-BLE functionality
Restrict Bluetooth pairing to trusted devices only, reducing adjacent attack surface

Patch Information

The fix is available in multiple Linux stable branches. Relevant upstream commits include Linux Kernel Commit 2061d08, Linux Kernel Commit 3c40d38, Linux Kernel Commit 3d5d81d, Linux Kernel Commit 9903a04, Linux Kernel Commit 9afcb5e, Linux Kernel Commit b06203ac, Linux Kernel Commit d630c4b, and Linux Kernel Commit e673889. Rebuild custom kernels from the patched sources or install the updated kernel package from your distribution.

Workarounds

Blacklist the bluetooth_6lowpan module by adding blacklist bluetooth_6lowpan to /etc/modprobe.d/blacklist.conf
Unload the running module with rmmod bluetooth_6lowpan on hosts where the feature is not in use
Disable Bluetooth entirely on servers and workstations that do not require it, using systemctl disable --now bluetooth.service

bash

# Configuration example
echo "blacklist bluetooth_6lowpan" | sudo tee /etc/modprobe.d/disable-6lowpan.conf
sudo rmmod bluetooth_6lowpan 2>/dev/null || true
sudo update-initramfs -u