CVE-2026-23151: Bluetooth: MGMT: Fix memory leak in set_ssp_complete
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: Fix memory leak in setsspcomplete
Fix memory leak in setsspcomplete() where mgmtpendingcmd structures are not freed after being removed from the pending list.
Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") replaced mgmtpendingforeach() calls with individual command handling but missed adding mgmtpendingfree() calls in both error and success paths of setsspcomplete(). Other completion functions like setlecomplete() were fixed correctly in the same commit.
This causes a memory leak of the mgmtpendingcmd structure and its associated parameter data for each SSP command that completes.
Add the missing mgmtpendingfree(cmd) calls in both code paths to fix the memory leak. Also fix the same issue in setadvertisingcomplete().
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required, with no user interaction. The impact is limited to availability through memory exhaustion; no confidentiality or integrity impact is indicated.
Which operations trigger the leak?
The leak occurs when SSP commands complete, because pending command structures and associated parameter data are not freed on either success or error paths. The same issue also affects completion of advertising operations in set_advertising_complete().
What can be done if patching cannot be applied immediately?
The provided data identifies a patch as available, but does not specify a configuration workaround. Reducing access for low-privileged local users may limit who can trigger the affected Bluetooth management operations.
How can administrators determine whether a system is affected?
Review the kernel source or applied stable commits for the missing mgmt_pending_free(cmd) calls in the success and error paths of set_ssp_complete() and in set_advertising_complete(). The referenced stable commits provide the available fixes.