CVE-2026-53252
Received Received - Intake
Bluetooth Memory Leak in Linux Kernel

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix memory leak in error path of hci_alloc_dev() Early failures in Bluetooth HCI UART configuration leak SRCU percpu memory. When device initialization fails before hci_register_dev() completes, the HCI_UNREGISTER flag is never set. As a result, when the device reference count reaches zero, bt_host_release() evaluates this flag as false and falls back to a direct kfree(hdev). Because hci_release_dev() is bypassed, the SRCU struct initialized early in hci_alloc_dev() is never cleaned up, resulting in a leak of percpu memory. Fix the leak by explicitly calling cleanup_srcu_struct() in the fallback (unregistered) branch of bt_host_release() before freeing the device.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-53252
EUVD
EUVD-2026-39203
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a memory leak in the Linux kernel's Bluetooth subsystem, specifically in the error handling path of the hci_alloc_dev() function.

When the Bluetooth device initialization fails early, before the device is fully registered, a flag (HCI_UNREGISTER) is not set. Because of this, the cleanup function that normally frees certain memory structures is bypassed.

As a result, a special type of memory called SRCU percpu memory, which was allocated early during device setup, is never freed, causing a memory leak.

The fix involves explicitly calling a cleanup function (cleanup_srcu_struct()) in the error path before freeing the device to ensure the leaked memory is properly released.

Impact Analysis

This vulnerability can lead to a memory leak in the Linux kernel when Bluetooth device initialization fails early.

Over time, repeated failures could cause the system to consume more memory than expected, potentially leading to degraded system performance or instability.

In environments where Bluetooth devices are frequently connected and disconnected or where initialization errors occur, this could increase the risk of resource exhaustion.

Mitigation Strategies

The vulnerability is fixed in the Linux kernel by explicitly calling cleanup_srcu_struct() in the fallback (unregistered) branch of bt_host_release() before freeing the device. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53252. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart