CVE-2026-53252

Analyzed Analyzed - Analysis Complete

Bluetooth Memory Leak in Linux Kernel

Publication date: 2026-06-25

Last updated on: 2026-07-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix memory leak in error path of hci_alloc_dev() Early failures in Bluetooth HCI UART configuration leak SRCU percpu memory. When device initialization fails before hci_register_dev() completes, the HCI_UNREGISTER flag is never set. As a result, when the device reference count reaches zero, bt_host_release() evaluates this flag as false and falls back to a direct kfree(hdev). Because hci_release_dev() is bypassed, the SRCU struct initialized early in hci_alloc_dev() is never cleaned up, resulting in a leak of percpu memory. Fix the leak by explicitly calling cleanup_srcu_struct() in the fallback (unregistered) branch of bt_host_release() before freeing the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-08

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53252

EUVD

EUVD-2026-39203

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.16
linux	linux_kernel	6.16
linux	linux_kernel	6.16
linux	linux_kernel	6.16
linux	linux_kernel	6.16
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.15.5 (inc) to 6.16 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.16.1 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.1.167 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 5.10.259 (inc) to 5.11 (exc)
linux	linux_kernel	From 6.12.36 (inc) to 6.12.94 (exc)
linux	linux_kernel	From 6.6.97 (inc) to 6.6.143 (exc)
linux	linux_kernel	5.15.209

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability is a memory leak in the Linux kernel's Bluetooth subsystem, specifically in the error handling path of the hci_alloc_dev() function.

When the Bluetooth device initialization fails early, before the device is fully registered, a flag (HCI_UNREGISTER) is not set. Because of this, the cleanup function that normally frees certain memory structures is bypassed.

As a result, a special type of memory called SRCU percpu memory, which was allocated early during device setup, is never freed, causing a memory leak.

The fix involves explicitly calling a cleanup function (cleanup_srcu_struct()) in the error path before freeing the device to ensure the leaked memory is properly released.

Impact Analysis

This vulnerability can lead to a memory leak in the Linux kernel when Bluetooth device initialization fails early.

Over time, repeated failures could cause the system to consume more memory than expected, potentially leading to degraded system performance or instability.

In environments where Bluetooth devices are frequently connected and disconnected or where initialization errors occur, this could increase the risk of resource exhaustion.

Mitigation Strategies

The vulnerability is fixed in the Linux kernel by explicitly calling cleanup_srcu_struct() in the fallback (unregistered) branch of bt_host_release() before freeing the device. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Hi! I’m here to help you understand CVE-2026-53252. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70