Bluetooth: fix memory leak in error path of hci_alloc_dev() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.13 % · percentile 3 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix memory leak in error path of hci_alloc_dev() Early failures in Bluetooth HCI UART configuration leak SRCU percpu memory. When device initialization fails before hci_register_dev() completes, the HCI_UNREGISTER flag is never set. As a result, when the device reference count reaches zero, bt_host_release() evaluates this flag as false and falls back to a direct kfree(hdev). Because hci_release_dev() is bypassed, the SRCU struct initialized early in hci_alloc_dev() is never cleaned up, resulting in a leak of percpu memory. Fix the leak by explicitly calling cleanup_srcu_struct() in the fallback (unregistered) branch of bt_host_release() before freeing the device.
Weaknesses (CWE)
- CWE-401 — Missing Release of Memory after Effective Lifetime
References
- https://git.kernel.org/stable/c/5b7dfca6f852e6b9d809fd0263b5427cc9fb33fd
- https://git.kernel.org/stable/c/c016118b9e51eeaf5bc93850d4c455a3b583c0aa
- https://git.kernel.org/stable/c/0622e527a31d4b44737fed5c1a2ac1fc2cfb5184
- https://git.kernel.org/stable/c/bc2efe73c194a74839d7cf57b63880d97e21d309
- https://git.kernel.org/stable/c/ce4b4cac3c5749b6aa75e62e2991ae2263f2f889
- https://git.kernel.org/stable/c/f82799407a50af7bcacacf09cc9b279af8fe9b81
- https://git.kernel.org/stable/c/37b3009bf5976e8ab77c8b9a9bc3bbd7ff49e37f
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-39203
- GCVE · GCVE-0-2026-53252
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1252 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1203 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1162 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1091 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1064 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1029 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0862 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0812 — Multiples vulnérabilités dans Microsoft Azure Linux · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.259 < 5.11cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1.167 < 6.1.176cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6.97 < 6.6.143cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.12.36 < 6.12.94cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.15.5 < 6.16cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.16.1 < 6.18.36cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 7.0.13cpe:2.3:o:linux:linux_kernel:5.15.209:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.16:rc7:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 90dee0a0ff84fac8accd5be98412b3819f667149 < 5b7dfca6f852e6b9d809fd0263b5427cc9fb33fd ; affected c56b177efce8b62798e4d96bdb9867106cb7c4a0 < c016118b9e51eeaf5bc93850d4c455a3b583c0aa ; affected bc0819a25e04cd68ef3568cfa51b63118fea39a7 < 0622e527a31d4b44737fed5c1a2ac1fc2cfb5184 ; affected ce23b73f0f27e2dbeb81734a79db710f05aa33c6 < bc2efe73c194a74839d7cf57b63880d97e21d309 ; affected 1d6123102e9fbedc8d25bf4731da6d513173e49e < ce4b4cac3c5749b6aa75e62e2991ae2263f2f889 ; affected 1d6123102e9fbedc8d25bf4731da6d513173e49e < f82799407a50af7bcacacf09cc9b279af8fe9b81 |
| Linux · Linux | affected 6.16 ; unaffected 0 < 6.16 ; unaffected 5.15.210 ≤ 5.15.* ; unaffected 6.1.176 ≤ 6.1.* ; unaffected 6.6.143 ≤ 6.6.* ; unaffected 6.12.94 ≤ 6.12.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |