Linux Kernel CVE-2026-43022

Exploitation requires: (1) authenticated local user account on the target system (PR:L), (2) Bluetooth subsystem enabled and loaded in the kernel (non-default in some server deployments but standard in client/IoT systems), (3) ability to access Bluetooth HCI interface or trigger HCI commands through user-space tools (bluetoothctl, hcitool, or custom applications), and (4) specific sequence of duplicate HCI command queue operations. Systems without Bluetooth hardware or with Bluetooth subsystem explicitly disabled in kernel configuration are not vulnerable. Exploitation does not require physical Bluetooth connectivity; commands can be queued via software interfaces. This is NOT remote or default-configuration exploitation - mandatory local authentication and Bluetooth subsystem presence significantly limit attack surface.

CVSS 5.5 with local attack vector (AV:L) and low attack complexity indicates moderate baseline severity limited to authenticated local attackers. However, EPSS score of 0.02% percentile (5th percentile) signals extremely low real-world exploitation probability despite KEV status unknown. The mismatch between CVSS (5.5, denial of service impact) and EPSS (minimal exploitation likelihood) suggests this is a niche, condition-dependent vulnerability. Attack complexity is low and requires low privileges (PR:L), but the impact is confined to availability (A:H) with no confidentiality or integrity compromise. The vulnerability requires authenticated local access to a system with Bluetooth subsystem active and specific HCI command patterns being queued. No KEV confirmation or public exploit identified. Risk is primarily to availability of affected systems rather than credential compromise or lateral movement. Real-world priority depends on deployment context: high-availability systems with local Bluetooth access and untrusted users present higher risk; server-only deployments with no Bluetooth hardware present negligible risk.

An authenticated local user with access to a Linux system running a vulnerable kernel version could repeatedly queue Bluetooth HCI commands through device interfaces, triggering the resource leak in hci_cmd_sync_queue_once(). By exploiting the improper return value handling, the attacker causes accumulation of unreleased resources, eventually exhausting kernel memory or preventing legitimate Bluetooth operations, resulting in system denial of service or crash.