CVE-2026-63991

Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

State: Published
Severity: Not scored
Published: Jul 19, 2026
Updated: Jul 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

The skb_clone() function can return NULL if memory allocation fails. send_mcast_pkt() calls skb_clone() without checking the return value, which can lead to a NULL pointer dereference in send_pkt() when it dereferences skb->data. Add a NULL check after skb_clone() and skip the peer if the clone fails.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	18722c247023035b9e2e2a08a887adec2a9a6e49 to before 9afcb5ea080af13aab37930da627db43bd277665Affected 18722c247023035b9e2e2a08a887adec2a9a6e49 to before 9903a04becf059e44cccf625e23689b7d4378384Affected 18722c247023035b9e2e2a08a887adec2a9a6e49 to before d630c4b25f36e0e68461561e4c70957ec37fdeddAffected 18722c247023035b9e2e2a08a887adec2a9a6e49 to before b06203ac5f12929d79146bb9f063c2af1d679e63Affected 18722c247023035b9e2e2a08a887adec2a9a6e49 to before 3d5d81d294ba09487c86bc4ba33dc4a4bec5d215Affected 18722c247023035b9e2e2a08a887adec2a9a6e49 to before e673889a35a5e4c586d0fae67d8755ca4367d3e2Affected 18722c247023035b9e2e2a08a887adec2a9a6e49 to before 2061d080a013c0ec0a56162cd501fb36d2befc26Affected 18722c247023035b9e2e2a08a887adec2a9a6e49 to before 3c40d381ce04f9575a5d8b542898183c3b4b38dcAffected
LinuxLinux	3.14Affected before 3.14Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

18722c247023035b9e2e2a08a887adec2a9a6e49 to before 9afcb5ea080af13aab37930da627db43bd277665Affected
18722c247023035b9e2e2a08a887adec2a9a6e49 to before 9903a04becf059e44cccf625e23689b7d4378384Affected
18722c247023035b9e2e2a08a887adec2a9a6e49 to before d630c4b25f36e0e68461561e4c70957ec37fdeddAffected
18722c247023035b9e2e2a08a887adec2a9a6e49 to before b06203ac5f12929d79146bb9f063c2af1d679e63Affected
18722c247023035b9e2e2a08a887adec2a9a6e49 to before 3d5d81d294ba09487c86bc4ba33dc4a4bec5d215Affected
18722c247023035b9e2e2a08a887adec2a9a6e49 to before e673889a35a5e4c586d0fae67d8755ca4367d3e2Affected
18722c247023035b9e2e2a08a887adec2a9a6e49 to before 2061d080a013c0ec0a56162cd501fb36d2befc26Affected
18722c247023035b9e2e2a08a887adec2a9a6e49 to before 3c40d381ce04f9575a5d8b542898183c3b4b38dcAffected

LinuxLinux

3.14Affected
before 3.14Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.