Skip to main content

Linux Kernel EUVDEUVD-2026-39203

| CVE-2026-53252 MEDIUM
Memory Leak (CWE-401)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-7mrh-gfr7-2p24
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local error-path trigger requires low privileges and Bluetooth module access; only availability is impacted via percpu memory exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 17:29 vuln.today
CVSS changed
Jul 08, 2026 - 16:52 NVD
5.5 (MEDIUM)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: fix memory leak in error path of hci_alloc_dev()

Early failures in Bluetooth HCI UART configuration leak SRCU percpu memory.

When device initialization fails before hci_register_dev() completes, the HCI_UNREGISTER flag is never set. As a result, when the device reference count reaches zero, bt_host_release() evaluates this flag as false and falls back to a direct kfree(hdev).

Because hci_release_dev() is bypassed, the SRCU struct initialized early in hci_alloc_dev() is never cleaned up, resulting in a leak of percpu memory.

Fix the leak by explicitly calling cleanup_srcu_struct() in the fallback (unregistered) branch of bt_host_release() before freeing the device.

AnalysisAI

Percpu memory leak in the Linux kernel Bluetooth subsystem allows a local low-privileged user to exhaust kernel memory by repeatedly triggering early failures in Bluetooth HCI UART device initialization. Affected kernels spanning stable branches from 5.10 through 6.16-rc4 fail to invoke cleanup_srcu_struct() when hci_register_dev() never completes, causing the SRCU struct allocated early in hci_alloc_dev() to persist indefinitely. No public exploit code has been identified at time of analysis, and EPSS at 0.19% (9th percentile) reflects negligible exploitation interest; however the availability impact is rated High by NVD given the potential for kernel memory exhaustion.

Technical ContextAI

The vulnerability (CWE-401, Missing Release of Memory after Effective Lifetime) resides in the Linux kernel Bluetooth HCI (Host Controller Interface) subsystem, specifically the UART transport layer. The hci_alloc_dev() function allocates and initializes an SRCU (Sleepable Read-Copy-Update) struct early in device setup. If initialization fails before hci_register_dev() completes, the HCI_UNREGISTER flag is never set on the device. When the device reference count reaches zero, bt_host_release() evaluates this flag as false and falls back to a bare kfree(hdev), bypassing hci_release_dev() entirely. This leaves the SRCU struct - which includes per-CPU memory allocations - unreclaimed. The fix adds an explicit cleanup_srcu_struct() call in the unregistered fallback branch of bt_host_release(). CPE: cpe:2.3:o:linux:linux_kernel across multiple stable branches.

RemediationAI

Update the Linux kernel to a fixed stable release: 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1 as applicable to the deployment branch. Upstream fixes are available at multiple kernel.org stable commits, including https://git.kernel.org/stable/c/0622e527a31d4b44737fed5c1a2ac1fc2cfb5184 and https://git.kernel.org/stable/c/f82799407a50af7bcacacf09cc9b279af8fe9b81 among others. Distribution-specific kernels (RHEL, Debian, Ubuntu, SUSE) should be updated via standard package management once vendor-backported packages become available. If patching is not immediately possible, disabling Bluetooth kernel modules (rmmod btusb hci_uart) eliminates the vulnerable code path at the cost of losing Bluetooth functionality. This workaround is effective because the leak only triggers during Bluetooth HCI device initialization failures. No confidentiality or integrity mitigations are required given the DoS-only impact.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-39203 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy