Linux Kernel CVE-2026-43022

The vulnerability exists in the Linux kernel's Bluetooth HCI (Host Controller Interface) subsystem, specifically in the hci_sync module's hci_cmd_sync_queue_once() function. This function manages synchronous command queueing for Bluetooth device communication. The root cause is inadequate return value signaling - the function did not differentiate between successful queue insertion and cases where an identical queue item already existed, preventing callers from determining whether callbacks would be invoked. This ambiguity caused resource cleanup code paths to fail, as callers could not know whether to release resources associated with queued operations. The fix modifies the function to return -EEXIST when a duplicate item is detected, enabling proper callback tracking and resource lifecycle management across all call sites. CWE classification not specified, but this represents a resource management and state synchronization defect in kernel-level Bluetooth protocol handling.