CVE-2026-43069
Bluetooth Firmware Leak in Linux Kernel
Publication date: 2026-05-05
Last updated on: 2026-05-05
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Bluetooth component, specifically in the hci_ll.c file within the download_firmware() function.
When the function request_firmware() successfully returns firmware data that is invalid (such as having no data or zero size), the firmware resource is not released properly. This causes a resource leak because release_firmware() is not called before the function returns.
The issue was fixed by ensuring that release_firmware() is called to free the firmware resource when invalid firmware content is detected after a successful request.
How can this vulnerability impact me? :
This vulnerability can lead to a resource leak in the Linux kernel's Bluetooth firmware handling.
Resource leaks can cause increased memory usage or depletion of system resources over time, potentially leading to degraded system performance or instability.
In environments where Bluetooth firmware is frequently updated or loaded, this could result in system slowdowns or crashes if the leak accumulates.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed in the Linux kernel by ensuring that release_firmware() is called when the firmware content is invalid after a successful request_firmware() call. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.
- Check your current Linux kernel version.
- Update the Linux kernel to the latest available version that contains the fix for the Bluetooth hci_ll firmware leak.
- Reboot the system after the kernel update to apply the changes.