Executive brief
A vulnerability in the Linux kernel's Bluetooth subsystem can lead to a memory leak during certain hardware configuration failures. Specifically, if a Bluetooth device fails to initialize early in its setup process, the system may fail to release specific internal memory structures. Over time, repeated initialization failures could consume system memory, potentially impacting performance or stability.
Technical details
A memory leak vulnerability was identified in the Linux kernel Bluetooth HCI UART configuration. When device initialization fails before hci_register_dev() is called, the HCI_UNREGISTER flag is not set. Consequently, when the device reference count reaches zero, the bt_host_release() function bypasses hci_release_dev() and performs a direct kfree(hdev). This bypass prevents the cleanup of the Sleepable Read-Copy-Update (SRCU) structure initialized in hci_alloc_dev(), leading to a leak of percpu memory. The fix involves explicitly calling cleanup_srcu_struct() in the fallback branch of bt_host_release().
Affected products
- Linux Linux Kernel 5.15.209 to 5.15.210; 6.1.167 to 6.1.176; 6.6.97 to 6.6.143; 6.12.36 to 6.12.94
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory
References
- https://git.kernel.org/stable/c/0622e527a31d4b44737fed5c1a2ac1fc2cfb5184
- https://git.kernel.org/stable/c/37b3009bf5976e8ab77c8b9a9bc3bbd7ff49e37f
- https://git.kernel.org/stable/c/5b7dfca6f852e6b9d809fd0263b5427cc9fb33fd
- https://git.kernel.org/stable/c/bc2efe73c194a74839d7cf57b63880d97e21d309
- https://git.kernel.org/stable/c/c016118b9e51eeaf5bc93850d4c455a3b583c0aa
- https://git.kernel.org/stable/c/ce4b4cac3c5749b6aa75e62e2991ae2263f2f889
- https://git.kernel.org/stable/c/f82799407a50af7bcacacf09cc9b279af8fe9b81