Executive brief
A memory leak vulnerability was identified in the Linux kernel's Bluetooth management component. This issue occurs when processing certain Bluetooth pairing and advertising commands, causing the system to fail to release memory after the operations complete. Over time, an attacker could exploit this to exhaust system memory, potentially leading to a system crash or service disruption.
Technical details
A memory leak exists in the net/bluetooth/mgmt.c component of the Linux kernel. The vulnerability stems from a regression in commit 302a1f674c00, where mgmt_pending_free() calls were omitted in the error and success paths of set_ssp_complete() and set_advertising_complete() after switching to individual command handling. A local attacker with low privileges can trigger these paths by repeatedly issuing Secure Simple Pairing (SSP) or advertising commands. This results in the accumulation of un-freed mgmt_pending_cmd structures and associated parameter data, eventually leading to kernel memory exhaustion (Denial of Service). Patches have been released for various stable kernel branches including 6.12.y, 6.17.y, and 6.18.y.
Affected products
- Linux Linux Kernel 6.12.59 to 6.12.69, 6.16.10 to 6.17, 6.17.1 to 6.18.9, 6.19-rc1 to 6.19-rc7
Timeline
- 2026-01-21: other: Patch authored
- 2026-02-14: disclosed: CVE published
- 2026-02-14: advisory
- 2026-05-17: patched: Final stable tree updates applied