CVE-2026-23151
Memory Leak in Linux Kernel Bluetooth MGMT set_ssp_complete
Publication date: 2026-02-14
Last updated on: 2026-05-17
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.12.59 (inc) to 6.12.69 (exc) |
| linux | linux_kernel | From 6.16.10 (inc) to 6.17 (exc) |
| linux | linux_kernel | From 6.17.1 (inc) to 6.18.9 (exc) |
| linux | linux_kernel | 6.17 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a memory leak in the Linux kernel's Bluetooth management code, specifically in the set_ssp_complete() function.
The issue occurs because mgmt_pending_cmd structures are not freed after being removed from the pending list, causing memory to be consumed unnecessarily.
A previous commit replaced certain function calls but missed adding the necessary free calls in both error and success paths of set_ssp_complete(), leading to this leak.
The fix involves adding the missing mgmt_pending_free(cmd) calls to properly release memory and also correcting the same issue in set_advertising_complete().
How can this vulnerability impact me? :
This vulnerability can cause a memory leak in the Linux kernel's Bluetooth management system.
Over time, the leak could lead to increased memory consumption, potentially degrading system performance or causing instability.
In environments with heavy Bluetooth usage, this could result in resource exhaustion or crashes if the leak is not addressed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is a memory leak in the Linux kernel's Bluetooth MGMT subsystem related to the set_ssp_complete function.
To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix which adds the missing mgmt_pending_free(cmd) calls in both error and success paths of set_ssp_complete and set_advertising_complete functions.