Executive brief
A vulnerability in the Linux kernel's Bluetooth driver could allow a local user to cause a resource leak. This occurs when the system attempts to load Bluetooth firmware but encounters invalid data. Over time, repeated occurrences could exhaust system memory, potentially leading to a system slowdown or crash.
Technical details
A resource leak exists in the download_firmware() function within drivers/bluetooth/hci_ll.c. When request_firmware() successfully allocates a firmware object but the content is found to be invalid (e.g., zero size or no data), the function returns an error without calling release_firmware(). This results in a kernel memory leak. An attacker with the ability to trigger firmware loading or provide malformed firmware files could exploit this to exhaust system resources. The issue has been patched in multiple stable branches of the Linux kernel by ensuring release_firmware() is called on these error paths.
Affected products
- Linux Linux Kernel versions including drivers/bluetooth/hci_ll.c
Timeline
- 2026-03-15: other: Patch authored
- 2026-05-05: disclosed: CVE published
References
- https://git.kernel.org/stable/c/28904375d54b436a757641fb0331537778c0de5a
- https://git.kernel.org/stable/c/31148a7be723aa9f2e8fbd62424825ab8d577973
- https://git.kernel.org/stable/c/5213ef54528dd1ac79b846e30d8f72ce092794aa
- https://git.kernel.org/stable/c/95e8601af227b2b4390eecf8db6abdb9f6a91f17
- https://git.kernel.org/stable/c/9ecbfd93cd6de6c78cb7fd51fe079e36c7ff074b
- https://git.kernel.org/stable/c/a7803df606a7d22e896b030f619e1d9d20ae0c6b
- https://git.kernel.org/stable/c/b2dfbf1b5ff192cefd49574b951a4af9ddd32213