PT-2026-52347 · Linux · Linux

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-53252

NVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: fix memory leak in error path of hci alloc dev()

Early failures in Bluetooth HCI UART configuration leak SRCU percpu memory.

When device initialization fails before hci register dev() completes, the HCI UNREGISTER flag is never set. As a result, when the device reference count reaches zero, bt host release() evaluates this flag as false and falls back to a direct kfree(hdev).

Because hci release dev() is bypassed, the SRCU struct initialized early in hci alloc dev() is never cleaned up, resulting in a leak of percpu memory.

Fix the leak by explicitly calling cleanup srcu struct() in the fallback (unregistered) branch of bt host release() before freeing the device.

Related Identifiers

CVE-2026-53252

Affected Products

Linux

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-53252 · Security Note
• https://git.kernel.org/stable/c/5b7dfca6f852e6b9d809fd0263b5427cc9fb33fd · Note
• https://git.kernel.org/stable/c/c016118b9e51eeaf5bc93850d4c455a3b583c0aa · Note
• https://git.kernel.org/stable/c/0622e527a31d4b44737fed5c1a2ac1fc2cfb5184 · Note
• https://git.kernel.org/stable/c/37b3009bf5976e8ab77c8b9a9bc3bbd7ff49e37f · Note
• https://git.kernel.org/stable/c/ce4b4cac3c5749b6aa75e62e2991ae2263f2f889 · Note
• https://git.kernel.org/stable/c/f82799407a50af7bcacacf09cc9b279af8fe9b81 · Note
• https://git.kernel.org/stable/c/bc2efe73c194a74839d7cf57b63880d97e21d309 · Note