Executive brief
The Linux kernel's Bluetooth management interface has a memory leak when HCI commands are cancelled. When a device controller is unregistered, pending HCI commands are not properly freed, causing memory to accumulate and preventing the management socket from being released. This can lead to resource exhaustion and prevent proper cleanup of Bluetooth connections.
Technical details
The vulnerability is a memory leak in the Bluetooth MGMT subsystem's HCI command handling. The mgmt_hci_cmd_sync() function queues commands with a NULL destroy callback, meaning they are only freed when send_hci_cmd_sync() completes successfully. When an entry is cancelled (via _hci_cmd_sync_cancel_entry() or hci_cmd_sync_clear() during controller unregistration), the command data is not freed because no destroy callback is registered. The leaked data includes socket references that prevent proper resource cleanup. The fix adds a destroy callback (send_hci_cmd_sync_destroy) to ensure commands are freed regardless of whether they complete or are cancelled. No user interaction or special privileges are required; the leak occurs automatically during normal device lifecycle operations.
Affected products
- Linux Linux Kernel 5.x and 6.x (affected since introduction of MGMT_OP_HCI_CMD_SYNC in 5.13+)
Timeline
- 2026-09-17: disclosed
- 2026-08-07: patched: Fix committed upstream; backported to stable branches