CVE-2026-45816: 
NixOS vulnerability analysis and mitigation

CVE-2026-45816 is a NULL Pointer Dereference vulnerability (CWE-476) in Apache NimBLE, an open-source Bluetooth Low Energy stack, affecting the LE Long Term Key (LTK) Request event handler in the Security Manager Protocol (SMP). It affects all versions of Apache NimBLE through 1.9.0 and was disclosed on July 24, 2026, with a fix released in version 1.10.0. The vulnerability was reported by Chongqing Lei and publicly disclosed by Apache committer Szymon Janc (oss-security, Apache Advisory). It carries a CVSS v3.1 base score of 7.5 (High), though the Apache advisory characterizes the practical severity as low due to the specific preconditions required (GitHub Advisory).

The root cause is a missing NULL check in the ble_sm_ltk_req_rx() function within nimble/host/src/ble_sm.c. When an LE Long Term Key Request HCI event is received, the function previously called ble_hs_conn_find_assert() only in a conditional branch (when restore is true), leaving a code path where the connection object could be NULL and subsequently dereferenced without validation. The fix (commit 9448c5f) moves the NULL check to the top of the function, returning BLE_HS_ENOENT immediately if the connection handle is invalid (GitHub Commit). Exploitation requires two preconditions: debug assertions must be disabled in the build (otherwise the assert fires before the dereference), and the Bluetooth controller must be bogus or misbehaving — sending an LTK request with an invalid connection handle (oss-security).

Successful exploitation results in a crash of the NimBLE host stack, causing a Denial of Service (DoS) on the affected embedded device. There is no impact on confidentiality or data integrity — the vulnerability is purely an availability issue. Given that NimBLE is commonly deployed in resource-constrained IoT and embedded systems (e.g., devices running Apache Mynewt), a crash could disrupt Bluetooth connectivity on those devices until they are restarted (GitHub Advisory, oss-security).

1. Precondition — Disabled Asserts: Confirm the target device is running Apache NimBLE through 1.9.0 compiled without debug assertions (e.g., NDEBUG defined or BLE_HS_DEBUG disabled), as enabled asserts would terminate execution before the NULL dereference occurs.
2. Attacker-Controlled Controller: Position a malicious or emulated Bluetooth controller (e.g., using a modified HCI firmware or a software-defined radio with custom HCI stack) that can send crafted HCI events to the NimBLE host.
3. Send Bogus LTK Request: Transmit an LE Long Term Key Request HCI event (HCI_LE_LTK_REQUEST) referencing an invalid or non-existent connection handle to the NimBLE host.
4. Trigger NULL Dereference: The ble_sm_ltk_req_rx() function processes the event, fails to find a valid connection object for the bogus handle, and dereferences the NULL pointer — crashing the NimBLE host stack and causing a DoS on the target device (GitHub Commit, oss-security).

• Process/System: Unexpected crash or restart of the NimBLE host stack process or the embedded device running Apache Mynewt with NimBLE.
• Logs: Crash dump or fault log entries referencing a NULL pointer dereference in ble_sm.c or the ble_sm_ltk_req_rx function; absence of assert-triggered logs (since asserts must be disabled for exploitation).
• Bluetooth: Unexpected LE Long Term Key Request HCI events received with connection handles that do not correspond to any active connection, observable via HCI sniffing tools (e.g., Wireshark with a Bluetooth sniffer).

Users should upgrade Apache NimBLE to version 1.10.0, which includes the fix that adds a NULL check at the start of ble_sm_ltk_req_rx() (Apache Advisory, GitHub Commit). As a temporary workaround, enabling debug assertions in the build configuration will cause the assert to fire before the NULL dereference, preventing the crash (though this is not suitable for production builds). Additionally, restricting physical or logical access to the Bluetooth controller interface reduces the attack surface, as exploitation requires a misbehaving or attacker-controlled controller.

The vulnerability was disclosed via the Apache security mailing list and oss-security by Szymon Janc, crediting Chongqing Lei as the reporter (oss-security). Community reaction has been minimal, consistent with the low practical severity and limited exploitation potential. The advisory was noted on Bluesky by infosec community accounts shortly after disclosure, and standard vulnerability aggregators (VulDB, Vulners, CVEFeed) indexed the issue promptly.