Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
Summary
| CVE | CVE-2026-63991 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-19 16:17:37 UTC |
| Updated | 2026-07-19 16:17:37 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() The skb_clone() function can return NULL if memory allocation fails. send_mcast_pkt() calls skb_clone() without checking the return value, which can lead to a NULL pointer dereference in send_pkt() when it dereferences skb->data. Add a NULL check after skb_clone() and skip the peer if the clone fails. |
Risk And Classification
EPSS: 0.001760000 probability, percentile 0.073920000 (date 2026-07-20)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 18722c247023035b9e2e2a08a887adec2a9a6e49 9afcb5ea080af13aab37930da627db43bd277665 git | Not specified |
| CNA | Linux | Linux | affected 18722c247023035b9e2e2a08a887adec2a9a6e49 9903a04becf059e44cccf625e23689b7d4378384 git | Not specified |
| CNA | Linux | Linux | affected 18722c247023035b9e2e2a08a887adec2a9a6e49 d630c4b25f36e0e68461561e4c70957ec37fdedd git | Not specified |
| CNA | Linux | Linux | affected 18722c247023035b9e2e2a08a887adec2a9a6e49 b06203ac5f12929d79146bb9f063c2af1d679e63 git | Not specified |
| CNA | Linux | Linux | affected 18722c247023035b9e2e2a08a887adec2a9a6e49 3d5d81d294ba09487c86bc4ba33dc4a4bec5d215 git | Not specified |
| CNA | Linux | Linux | affected 18722c247023035b9e2e2a08a887adec2a9a6e49 e673889a35a5e4c586d0fae67d8755ca4367d3e2 git | Not specified |
| CNA | Linux | Linux | affected 18722c247023035b9e2e2a08a887adec2a9a6e49 2061d080a013c0ec0a56162cd501fb36d2befc26 git | Not specified |
| CNA | Linux | Linux | affected 18722c247023035b9e2e2a08a887adec2a9a6e49 3c40d381ce04f9575a5d8b542898183c3b4b38dc git | Not specified |
| CNA | Linux | Linux | affected 3.14 | Not specified |
| CNA | Linux | Linux | unaffected 3.14 semver | Not specified |
| CNA | Linux | Linux | unaffected 5.10.259 5.10.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.15.210 5.15.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.176 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.143 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.93 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.35 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.0.12 7.0.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/3c40d381ce04f9575a5d8b542898183c3b4b38dc | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/b06203ac5f12929d79146bb9f063c2af1d679e63 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/e673889a35a5e4c586d0fae67d8755ca4367d3e2 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/3d5d81d294ba09487c86bc4ba33dc4a4bec5d215 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/9903a04becf059e44cccf625e23689b7d4378384 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/9afcb5ea080af13aab37930da627db43bd277665 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/d630c4b25f36e0e68461561e4c70957ec37fdedd | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/2061d080a013c0ec0a56162cd501fb36d2befc26 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.