Linux Kernel EUVD-2026-26620

The vulnerability exists in the Bluetooth HCI (Host Controller Interface) synchronization layer (hci_sync) of the Linux kernel. The hci_cmd_sync_queue_once() function is responsible for queuing Bluetooth commands synchronously with guaranteed single execution. When this function returns an error, the associated destroy callback-which is responsible for cleaning up allocated resources and releasing reference counts-is not invoked. This is a resource cleanup failure classified under CWE-401 (Missing Release of Memory After Effective Lifetime), a common pattern in kernel code where error paths fail to properly unwind resource allocation. The affected CPE indicates all Linux kernel versions are theoretically affected until the patch is applied.