Executive brief
A vulnerability in the Linux kernel's Bluetooth subsystem could allow a local user to cause a system resource leak. When certain Bluetooth features are used, the system may fail to properly release memory, potentially leading to a denial-of-service condition where the system becomes unstable or crashes due to memory exhaustion. This affects various Bluetooth protocols including HCI, ISO, L2CAP, and SCO.
Technical details
A resource leak (CWE-772) exists in the Linux kernel Bluetooth stack due to improper handling of the error queue (sk_error_queue) in socket destructors. When SO_TIMESTAMPING is enabled, socket buffer (SKB) structures are queued into the error queue for transmission timestamps; however, if these are not consumed by userspace or if the controller is removed, the SKBs are not purged during socket destruction. This affects hci_sock, iso_sock, l2cap_sock, and sco_sock. A local attacker can exploit this to exhaust system memory. The issue has been resolved by adding skb_queue_purge() calls to the affected destructors in stable kernel branches.
Affected products
- Linux Linux Kernel 6.15 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1
Timeline
- 2026-03-25: disclosed
- 2026-03-25: advisory
- 2026-02-23: patched: Initial patch committed to mainline