CVE-2026-45836

A flaw was found in the Linux kernel's Bluetooth L2CAP subsystem. This vulnerability, a null-pointer dereference, occurs due to a missing NULL guard in the l2cap_sock_get_sndtimeo_cb() function. A local attacker could exploit this flaw to trigger a system crash, leading to a Denial of Service (DoS).

This Moderate flaw in the Linux kernel's Bluetooth L2CAP subsystem allows a local attacker to trigger a null-pointer dereference, leading to a system crash and Denial of Service. Exploitation requires local access to the system, limiting the attack vector compared to remote vulnerabilities.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, if Bluetooth functionality is not required, the bluetooth kernel module can be prevented from loading. This can be achieved by creating a modprobe configuration file.

Create a file named /etc/modprobe.d/disable-bluetooth.conf with the following content: install bluetooth /bin/true blacklist bluetooth

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. dracut -f -v reboot

Disabling the bluetooth module will prevent all Bluetooth-related functionality on the system.