Skip to main content

Linux Kernel CVE-2026-53364

MEDIUM
Memory Leak (CWE-401)
2026-07-13 Linux
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access and low privilege required to invoke Bluetooth BIG teardown; impact is memory exhaustion only with no data exposure or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 22, 2026 - 20:06 vuln.today
CVSS changed
Jul 22, 2026 - 19:22 NVD
5.5 (MEDIUM)
CVE Published
Jul 13, 2026 - 17:33 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 13, 2026 - 17:33 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()

hci_le_big_terminate() allocates iso_list_data via kzalloc_obj but returns 0 without freeing it when neither pa_sync_term nor big_sync_term flags are set after evaluating the PA and BIG sync connection state.

This early-return path was introduced when hci_le_big_terminate() was refactored to take struct hci_conn instead of raw u8 parameters, adding PA/BIG flag evaluation logic. The existing kfree() on hci_cmd_sync_queue failure does not cover this path.

AnalysisAI

Memory leak in the Linux kernel's Bluetooth HCI layer allows a local low-privileged user to exhaust kernel memory by repeatedly triggering the Broadcast Isochronous Group (BIG) termination path. The affected function hci_le_big_terminate() allocates iso_list_data via kzalloc_obj but returns without freeing it when neither pa_sync_term nor big_sync_term flags are set - a code path introduced during a refactoring that added PA/BIG flag evaluation logic. No public exploit has been identified at time of analysis, and with EPSS at 0.15% (5th percentile), real-world exploitation probability is extremely low.

Technical ContextAI

The vulnerability is located in the Linux kernel's Bluetooth subsystem, specifically within hci_le_big_terminate() in the HCI connection management layer (net/bluetooth/hci_conn.c). The function handles teardown of LE Broadcast Isochronous Groups (BIG), a Bluetooth 5.2 feature used for isochronous audio broadcasting. The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime): when the function was refactored to accept a struct hci_conn pointer rather than raw u8 parameters, a new early-return branch was introduced for the case where neither the PA sync termination nor BIG sync termination flags are set. This path returns 0 (success) without calling kfree() on the iso_list_data object. The existing kfree() only guards the hci_cmd_sync_queue failure path, leaving this early-return path uncovered. CPE data (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) indicates all Linux kernel versions containing this refactored code are affected.

RemediationAI

Apply the upstream kernel stable-tree patches: commits e6b78019664dfe37c3dc707f50e7b453d6c7726d, a59d4f4217e6200ca9180643e5738a87d3fa8be0, and bfa9d28960ed677d556bdf097073bc3129686229, all available at https://git.kernel.org/stable/. Ubuntu users should apply the kernel updates referenced in USN-8568-1 and USN-8566-1; exact patched package version numbers must be retrieved from those advisories, as they are not specified in the available input data. For systems that do not require Bluetooth LE isochronous audio functionality, disabling the Bluetooth subsystem entirely (modprobe -r bluetooth or blacklisting via /etc/modprobe.d/) eliminates the attack surface with the trade-off of losing all Bluetooth capability. Restricting unprivileged user access to Bluetooth HCI devices via udev rules or removing users from the bluetooth group reduces exposure on multi-user systems, though this affects legitimate Bluetooth use cases.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53364 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy