Executive brief
A memory leak vulnerability was identified in the Linux kernel's Bluetooth driver for MediaTek devices. This issue occurs when certain Bluetooth communication tasks fail or are cancelled, causing the system to fail to release small amounts of memory. Over time, this could potentially lead to system instability or performance degradation, though it primarily affects the reliability of Bluetooth operations.
Technical details
A memory leak exists in drivers/bluetooth/btmtk.c within the Linux kernel. The vulnerability is caused by the failure to free the 'setup_packet' of a control USB Request Block (URB) in two specific error paths: when usb_submit_urb fails and when a submitted URB is killed (returning -ENOENT). This results in a kernel memory leak every time these error conditions are met during MediaTek Bluetooth operations. The fix involves adding kfree() calls for the setup_packet in the affected error handling paths within btmtk_usb_wmt_recv and btmtk_usb_submit_wmt_recv_urb.
Affected products
- Linux Linux 5.3 to 7.1
Timeline
- 2026-07-19: disclosed: CVE published and patches available in various stable branches.
References
- https://git.kernel.org/stable/c/0d2572bafea33c7cd1d77c6a25f25ff31a432482
- https://git.kernel.org/stable/c/2a1905730e0c771b999906a7b509722f795563c6
- https://git.kernel.org/stable/c/68c027c2003b0a8a1439d0301c59c6fd1eb3b844
- https://git.kernel.org/stable/c/a0f5268c77eb73f84ba7c210ddfc54b1c73ff80c
- https://git.kernel.org/stable/c/dd1dda6b8d6e1f4376a5b3055a04f0ecbdb4d6bd