CVE-2026-45834

Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()

MEDIUM

5.5

CVSS Score

Published: May 26, 2026 at 04:14 PM UTC

Updated: October 15, 2026 at 02:19 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Add the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

3.1 ≤ v < 5.10.2585.11 ≤ v < 5.15.2095.16 ≤ v < 6.1.1756.13 ≤ v < 6.18.306.19 ≤ v < 7.0.76.2 ≤ v < 6.6.1406.7 ≤ v < 6.12.887.1 7.1 rc1 7.1 rc289bc500e41fc5b48e0573e6b0d927fc97b8951dc

Vendor states this is fixed in 0c17c8832562b2aac288e89cefd0f46074f54bcb (fixed)

Vendor states this is fixed in 1810e42ff6716f320c7269d5850eca48b07b7427 (fixed)

Vendor states this is fixed in 1b1c0da227bf63479bac9982fc8d12df9aaea0fb (fixed)

Vendor states this is fixed in 2ff1a41a912de8517b4482e946dd951b7d80edbf (fixed)

Vendor states this is fixed in 5105f3e6b2df619c635b5f6a49fac131a36c7952 (fixed)

Vendor states this is fixed in 85426e97dc72f2088ba6d27e74cd58c3fbd43e31 (fixed)

Vendor states this is fixed in a2dcf1a61d056aef15b63c6eae9441344d624389 (fixed)

Vendor states this is fixed in c88c185ae0a1067823661b220aeea613df2c127b (fixed)

Vendor states this is fixed in 3.1 (unaffected)

Vendor states this is fixed in 5.10.258 (unaffected)

Vendor states this is fixed in 5.15.209 (unaffected)

Vendor states this is fixed in 6.1.175 (unaffected)