Linux Kernel EUVD-2026-45829

Exploitation requires local, low-privileged shell access to the target host (PR:L per CVSS vector; remote network exploitation is not possible). Beyond account access, the host must have a MediaTek Bluetooth USB adapter present with the btmtk_usb kernel module loaded-this is not a default condition on most server or cloud-instance hardware and is primarily relevant to workstations, embedded devices, or laptops with MediaTek Bluetooth chips. The attacker must be able to repeatedly trigger USB control transfer error conditions (usb_submit_urb failure or URB cancellation); a single trigger leaks a negligible amount of memory, so impact requires sustained repeated failures. Root or administrative privileges are not required. Factors limiting exploitation: physical or local virtual machine access is a hard prerequisite, MediaTek Bluetooth hardware must be present, and repeated error induction over time is necessary for meaningful availability impact.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5) accurately characterizes a local low-privilege memory leak with availability impact only, and the signals from every other data source reinforce a low urgency classification: EPSS of 0.18% at the 7th percentile indicates the vulnerability is not attracting automated exploitation or broad attacker interest, no CISA KEV listing exists, and no public proof-of-concept has been identified. Practically, triggering meaningful impact requires sustained repeated error conditions on a system with MediaTek Bluetooth USB hardware present-a constrained scenario that even a mid-sized municipal IT team in sopot would rarely encounter in normal server fleet operations. The 'Information Disclosure' tag in the source data should be disregarded as it conflicts with both the CWE and the CVSS confidentiality metric; no data leakage path is described. This is a legitimate stability fix appropriate for normal patch cycle inclusion but does not warrant emergency response or compensating control deployment.

A local user with standard non-root privileges on a Linux system with a MediaTek Bluetooth USB adapter repeatedly induces USB control transfer failures-for example by rapidly toggling the adapter or generating USB errors-causing setup_packet allocations to accumulate without being freed. Over time the leaked kernel memory degrades system stability and can lead to an out-of-memory condition, hanging or crashing the host. No public proof-of-concept exists for this scenario.