Executive brief
The Linux kernel's Bluetooth driver for MediaTek devices has a memory leak in its USB request block (URB) allocation function. When an error occurs during packet preparation, the previously allocated URB is not freed, causing kernel memory to be wasted. Over time, repeated errors could degrade system stability.
Technical details
A resource leak exists in the alloc_mtk_intr_urb() function within drivers/bluetooth/btmtk.c. When btmtk_isopkt_pad() fails and returns an error, the function returns an error pointer without first calling usb_free_urb() on the previously allocated URB structure, leaking kernel memory. The vulnerability is triggered only when btmtk_isopkt_pad() encounters a failure condition during ISO packet padding. The fix adds a usb_free_urb() call before the error return, ensuring proper cleanup in the error path.
Affected products
- Linux Linux kernel 5.x and later (affected in Bluetooth btmtk driver)
Timeline
- 2026-08-15: disclosed
- 2026-06-04: patched: Upstream fix committed by Zhao Dongdong