Executive brief
The Linux kernel's Bluetooth subsystem has a memory leak in the advertising instance timeout handler. When the handler queues a command to clear an advertising instance and that command fails or is cancelled, the allocated memory is not freed. This can lead to gradual memory exhaustion on systems that frequently enable and disable Bluetooth advertising, potentially degrading device performance over time.
Technical details
The vulnerability is a memory leak in the `adv_timeout_expire()` function within net/bluetooth/hci_sync.c. The function allocates memory via kmalloc() for an instance identifier and passes it to `hci_cmd_sync_queue()` with a NULL destroy callback. Memory is leaked in two scenarios: (1) when `hci_cmd_sync_queue()` fails to queue the command (returning -ENETDOWN, -ENODEV, or -ENOMEM) because the caller does not check the return value or free the buffer on failure, and (2) when a queued command is cancelled before execution because `_hci_cmd_sync_cancel_entry()` does not free entry data when no destroy callback is provided. The fix introduces a destroy callback (`adv_timeout_expire_destroy()`) to properly free the buffer, and adds explicit cleanup in the caller when queuing fails. A patch was committed upstream and backported to stable kernels.
Affected products
- Linux Linux kernel multiple versions through linux-6.9.y and earlier
Timeline
- 2026-09-17: disclosed
- 2026-08-07: patched: Upstream commit 120d8dc042e3d45073bb6e50ee7b058a0b182627