{"id":"CVE-2026-40695","kind":"vulnerability","aliases":["CVE-2026-40695"],"related":[],"title":"Intel Wireless Bluetooth driver: kernel null pointer lets local user crash system","description":"Null pointer dereference for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","summary":"A null pointer dereference in Intel Wireless Bluetooth driver code running in the kernel (Ring 0) lets a local user who is logged in cause a denial of service. The sources describe only an availability impact; no confidentiality or integrity loss is stated.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","infrastructure","intel","linux","windows"],"not_affected_if":["no-intel-bluetooth-hardware","no-local-untrusted-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T18:17:38+00:00","first_seen_at":"2026-11-10T18:22:57+00:00","triaged_at":"2026-11-10T18:24:43+00:00","updated_at":"2026-11-10T18:24:43+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T18:24:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Intel Wireless Bluetooth driver: kernel null pointer lets local user crash system","impact":"low","summary":"A null pointer dereference in Intel Wireless Bluetooth driver code running in the kernel (Ring 0) lets a local user who is logged in cause a denial of service. The sources describe only an availability impact; no confidentiality or integrity loss is stated.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel","windows","linux","bluetooth"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user crashes the kernel, denying service to the machine","analyst_note":"Find Intel's security advisory for this CVE to confirm affected driver versions and the fixed release; the NVD entry alone does not give them.","how_to_check":"unknown","plain_action":"","product_name":"Intel Wireless Bluetooth","needs_analyst":true,"not_affected_if":["no-intel-bluetooth-hardware","no-local-untrusted-users"],"who_is_affected":"Systems with Intel Wireless Bluetooth drivers installed where an authenticated local user could run unprivileged software. The sources do not list affected driver versions or configurations, so the exact exposure is unknown.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000721,"input_tokens":4659,"output_tokens":510,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-40695':15A,18A '0':39B,79C 'access':112C 'adversari':89C 'allow':82C 'attack':99C,114C 'authent':92C 'avail':58B,139C,154C 'bluetooth':3A,19B,31B,75C 'caus':48B 'code':33B 'combin':94C 'complex':98C 'confidenti':61B,134C,149C 'crash':11A 'cve':13A,16A 'denial':50B,84C,102C 'derefer':27B,69C 'describ':55B 'driver':4A,32B 'enabl':101C 'high':140C 'impact':59B,132C,156C 'infrastructur':20B 'integr':63B,136C,151C 'intel':1A,21B,29B,72C 'interact':127C 'intern':121C 'kernel':5A,37B,80C 'knowledg':122C 'let':8A,40B 'linux':22B 'local':9A,42B,111C 'log':46B 'loss':64B 'low':97C 'may':81C,100C,107C,131C 'none':135C,137C,150C,152C,155C 'null':6A,25B,67C 'occur':109C 'pointer':7A,26B,68C 'potenti':108C,129C 'present':118C 'r':73C,76C 'requir':115C,124C 'result':106C,145C 'ring':38B,78C 'run':34B 'servic':52B,86C,104C 'softwar':88C 'sourc':54B 'special':120C 'state':66B 'subsequ':147C 'system':12A,144C,148C 'unprivileg':87C 'user':10A,43B,93C,126C 'via':110C 'vulner':130C,143C 'window':23B 'wireless':2A,30B,74C 'within':77C 'without':119C","nicknames":[],"mitigations":[],"who_affected":"Systems with Intel Wireless Bluetooth drivers installed where an authenticated local user could run unprivileged software. The sources do not list affected driver versions or configurations, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bluetooth","infrastructure","intel","linux","medium","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-40695':15A,18A 'bluetooth':3A 'crash':11A 'cve':13A,16A 'driver':4A 'intel':1A 'kernel':5A 'let':8A 'local':9A 'null':6A 'pointer':7A 'system':12A 'user':10A 'wireless':2A","search_b":"'0':39B 'avail':58B 'bluetooth':19B,31B 'caus':48B 'code':33B 'confidenti':61B 'denial':50B 'derefer':27B 'describ':55B 'driver':32B 'impact':59B 'infrastructur':20B 'integr':63B 'intel':21B,29B 'kernel':37B 'let':40B 'linux':22B 'local':42B 'log':46B 'loss':64B 'null':25B 'pointer':26B 'ring':38B 'run':34B 'servic':52B 'sourc':54B 'state':66B 'user':43B 'window':23B 'wireless':30B","search_c":"'0':79C 'access':112C 'adversari':89C 'allow':82C 'attack':99C,114C 'authent':92C 'avail':139C,154C 'bluetooth':75C 'combin':94C 'complex':98C 'confidenti':134C,149C 'denial':84C,102C 'derefer':69C 'enabl':101C 'high':140C 'impact':132C,156C 'integr':136C,151C 'intel':72C 'interact':127C 'intern':121C 'kernel':80C 'knowledg':122C 'local':111C 'low':97C 'may':81C,100C,107C,131C 'none':135C,137C,150C,152C,155C 'null':67C 'occur':109C 'pointer':68C 'potenti':108C,129C 'present':118C 'r':73C,76C 'requir':115C,124C 'result':106C,145C 'ring':78C 'servic':86C,104C 'softwar':88C 'special':120C 'subsequ':147C 'system':144C,148C 'unprivileg':87C 'user':93C,126C 'via':110C 'vulner':130C,143C 'wireless':74C 'within':77C 'without':119C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-40695","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40695","severity":null,"published_at":"2026-11-10T18:17:38+00:00","modified_at":"2026-11-10T18:17:38+00:00","first_seen_at":"2026-11-10T18:22:57+00:00","fetched_at":"2026-11-10T18:22:57+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}