Skip to main content

Linux Kernel CVE-2026-53251

| EUVDEUVD-2026-39202 MEDIUM
Missing Release of Resource after Effective Lifetime (CWE-772)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-q6x9-g333-77r4
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local socket access with low privileges triggers the leak; no confidentiality or integrity impact, only availability via resource exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 17:28 vuln.today
CVSS changed
Jul 08, 2026 - 16:52 NVD
5.5 (MEDIUM)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync

hci_get_route() returns a reference-counted hci_dev pointer via hci_dev_hold(). The function exits normally or with an error without ever releasing it.

AnalysisAI

Reference leak in the Linux kernel Bluetooth ISO subsystem allows a local low-privileged user to exhaust kernel resources and cause a denial of service. The iso_conn_big_sync function acquires an hci_dev reference via hci_dev_hold() through hci_get_route() but never releases it, violating the borrow contract. No active exploitation has been confirmed and EPSS is very low at 0.18% (7th percentile), but the affected surface - the BLE Audio Broadcast Isochronous Group (BIG) synchronization path - is present on any Linux system with a Bluetooth controller.

Technical ContextAI

The Linux kernel Bluetooth stack exposes an ISO socket type supporting Broadcast Isochronous Groups (BIG), part of the Bluetooth 5.2 LE Audio specification. The Host Controller Interface (HCI) layer uses reference-counted hci_dev structures to manage physical Bluetooth controllers. hci_get_route() wraps hci_dev_hold() to increment that count, returning a held pointer that callers must release with hci_dev_put(). CWE-772 (Missing Release of Resource after Effective Lifetime) describes exactly this pattern: the iso_conn_big_sync() code path exits - both on success and on error - without ever invoking the corresponding hci_dev_put(), meaning every call to this function permanently leaks one reference. Repeated invocations will inflate the reference count without bound, preventing the hci_dev structure from ever being freed and ultimately exhausting slab memory. CPE data confirms all current Linux kernel versions up to the fix points in 6.12.94, 7.0.13, 7.1, and 6.18.36 are affected.

RemediationAI

Update to a patched stable kernel release: Linux 6.12.94, 7.0.13, 7.1 (final), or 6.18.36 as appropriate for the deployed series. Upstream fix commits are available at https://git.kernel.org/stable/c/23e8eb16820b866528fb300dc67fe3f67f00ef62 (mainline), https://git.kernel.org/stable/c/33d677d2e3713d98012c3dbd4a9207f7d785b854, https://git.kernel.org/stable/c/4bbec25f47b930101294fd310c627c3f53e9661f, and https://git.kernel.org/stable/c/5cbf290b79351971f20c7a533247e8d58a3f970c for respective stable branches. If immediate patching is not feasible, disabling the Bluetooth subsystem (modprobe -r bluetooth or building with CONFIG_BT=n) removes the attack surface entirely, at the cost of losing all Bluetooth functionality. Alternatively, restricting CAP_NET_RAW and socket creation via seccomp or AppArmor profiles to untrusted processes limits the ability to open ISO Bluetooth sockets and trigger the vulnerable code path, with the trade-off of potentially breaking legitimate Bluetooth audio applications.

Same weakness CWE-772 – Missing Release of Resource after Effective Lifetime

View all
CVE-2017-14495 HIGH POC
7.5
CVE-2024-20481 MEDIUM
5.8
CVE-2017-14138 CRITICAL POC
9.8
CVE-2020-12134 CRITICAL POC
9.8
CVE-2018-19760 HIGH POC
8.8
CVE-2017-13748 HIGH POC
7.5
CVE-2017-15268 HIGH POC
7.5
CVE-2017-11655 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53251 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy