Executive brief
The Linux kernel's Bluetooth management layer contains a memory leak in the mesh send cancel functionality. When a mesh send cancel command is cancelled instead of completing normally, the kernel fails to free the associated memory and socket reference, which can lead to resource exhaustion and denial of service if mesh operations are repeatedly cancelled.
Technical details
The vulnerability is a memory leak in the net/bluetooth/mgmt.c file in the mesh_send_cancel() and send_cancel() functions. The issue occurs because mesh_send_cancel() queues a pending command with a NULL destroy callback, causing the command data to be freed only if send_cancel() completes successfully. When the command is cancelled via _hci_cmd_sync_cancel_entry(), the entry data is not released because no destroy callback exists, and hci_cmd_sync_clear() (called on controller unregistration) cancels all pending entries without reclaiming leaked memory. Additionally, the leaked command holds a socket reference from mgmt_pending_new(), preventing the socket from being released. The fix introduces a send_cancel_destroy() callback to properly free the command data when cancellation occurs, ensuring cleanup in all code paths.
Affected products
- Linux Linux kernel multiple versions with Bluetooth mesh support
Timeline
- 2026-09-17: disclosed
- 2026-08-06: patched