Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem where the system fails to properly release internal resources during certain Bluetooth synchronization operations. This flaw could lead to a resource leak, potentially impacting system stability or performance over time as Bluetooth connections are established and closed. The issue specifically affects the handling of Broadcast Isochronous Groups (BIG) synchronization.
Technical details
A reference counting error exists in net/bluetooth/iso.c within the Linux kernel. The function hci_get_route() increments the reference count of an hci_dev structure via hci_dev_hold(), but the iso_conn_big_sync function fails to call hci_dev_put() before exiting. This results in a memory/resource leak where the Bluetooth device object is never freed. An attacker or local user could potentially trigger this leak repeatedly to exhaust system resources. The issue has been resolved by adding the missing hci_dev_put(hdev) call in the affected code path.
Affected products
- Linux Linux Kernel 6.11.11 to 6.12, 6.12.2 to 6.12.94, 6.13
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory