Intel Wireless Bluetooth: Null pointer dereference in kernel driver enables denial of service
Summary
Some Intel Wireless Bluetooth driver software versions contain a null pointer dereference in kernel mode (Ring 0). An authenticated local user or malware running as a standard user can trigger it, which can crash or hang the system. The flaw affects availability only; no data disclosure or code execution is described.
Affected
Unknown. The CVE record and research sources do not confirm the affected versions. Check Intel advisory INTEL-SA-01530.
Fixed in
Unknown. Intel advisory INTEL-SA-01530 must be checked for the fixed driver versions.
Workaround
- No vendor workaround found.
- Restrict local access to trusted users.
- Where Bluetooth is not needed, disable it via policy.
Exploitation
- Not known to be exploited according to a third-party aggregator.
- No public exploit code or CISA KEV listing found at the time of research.
Our recommendation
- Read Intel advisory INTEL-SA-01530 and record the affected and fixed driver versions.
- Inventory Intel Bluetooth driver versions across the fleet.
- Install the driver update in the next patch cycle, prioritising shared or high-risk endpoints.
- Monitor for Bluetooth-related crashes and re-check exploit feeds before the next review.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel advisory INTEL-SA-01530 intel.com
- Offseq threat page CVE-2026-40695 radar.offseq.com
- Strix CVE-2026-40695 www.strix.ai
- Intel support article 000005773 (IT admin) www.intel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:46.
Original description (NVD)
Null pointer dereference for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.