CVE-2026-23151: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23151 Overview

CVE-2026-23151 is a memory leak vulnerability in the Linux kernel's Bluetooth Management (MGMT) subsystem. The vulnerability exists in the set_ssp_complete() function where mgmt_pending_cmd structures are not properly freed after being removed from the pending list, leading to gradual memory exhaustion.

The issue was introduced when commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") replaced mgmt_pending_foreach() calls with individual command handling but failed to add the necessary mgmt_pending_free() calls in both error and success paths of set_ssp_complete(). The same issue also affects set_advertising_complete().

Critical Impact
Each SSP (Secure Simple Pairing) command that completes leaks memory, potentially leading to kernel memory exhaustion and system instability on systems with active Bluetooth usage.

Affected Products

Linux kernel (Bluetooth MGMT subsystem)
Systems with Bluetooth SSP functionality enabled
Affected kernel versions prior to the security fix

Discovery Timeline

2026-02-14 - CVE CVE-2026-23151 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23151

Vulnerability Analysis

This memory leak vulnerability occurs in the Linux kernel's Bluetooth Management subsystem, specifically within the set_ssp_complete() callback function. When a Secure Simple Pairing (SSP) command completes, the associated mgmt_pending_cmd structure should be freed to release the allocated kernel memory. However, due to an incomplete fix in a previous commit addressing Use-After-Free vulnerabilities, the memory deallocation step was inadvertently omitted.

The vulnerability affects both the error and success code paths within set_ssp_complete(), meaning that regardless of whether an SSP operation succeeds or fails, the associated command structure memory is leaked. Additionally, the same pattern of missing mgmt_pending_free() calls exists in set_advertising_complete().

Root Cause

The root cause traces back to commit 302a1f674c00 which refactored how pending MGMT commands are handled. While the commit correctly fixed other completion functions like set_le_complete() by adding appropriate mgmt_pending_free(cmd) calls, it missed adding these calls in set_ssp_complete() and set_advertising_complete(). This oversight results in the mgmt_pending_cmd structure and its associated parameter data remaining allocated indefinitely in kernel memory.

Attack Vector

The memory leak is triggered through normal Bluetooth SSP operations. Each time a Secure Simple Pairing command completes on an affected system, memory is leaked. On systems with frequent Bluetooth activity—such as those handling multiple device pairings or maintaining connections with numerous Bluetooth peripherals—the memory leak can accumulate over time, potentially leading to:

Gradual degradation of system performance
Kernel memory exhaustion
System instability or crashes in prolonged uptime scenarios
Denial of service conditions on embedded or resource-constrained devices

The vulnerability mechanism involves the following sequence: when an SSP command is initiated, a mgmt_pending_cmd structure is allocated. Upon command completion, the structure is removed from the pending list but the memory is never freed, causing the leak. Over time, particularly on systems with active Bluetooth usage, this can consume significant kernel memory.

Detection Methods for CVE-2026-23151

Indicators of Compromise

Gradual increase in kernel memory usage over time on systems with active Bluetooth
Memory pressure warnings in kernel logs correlating with Bluetooth SSP operations
Unexplained memory consumption growth without corresponding userspace activity
System performance degradation on long-running systems with Bluetooth enabled

Detection Strategies

Monitor kernel memory allocation statistics for unusual growth patterns
Track slab allocations related to Bluetooth subsystem objects
Implement kernel memory leak detection tools such as kmemleak to identify unreleased allocations
Review system logs for out-of-memory conditions or memory pressure events

Monitoring Recommendations

Enable kernel memory debugging features (CONFIG_DEBUG_KMEMLEAK) in development or testing environments
Monitor /proc/meminfo and /proc/slabinfo for unexpected memory consumption trends
Set up alerting for gradual memory exhaustion patterns on systems with Bluetooth enabled
Track Bluetooth MGMT command activity through the kernel's tracing infrastructure

How to Mitigate CVE-2026-23151

Immediate Actions Required

Update the Linux kernel to a patched version that includes the fix for CVE-2026-23151
Schedule system reboots for affected systems to reclaim leaked memory
Consider disabling Bluetooth SSP functionality if not required and patching is delayed
Monitor affected systems for memory exhaustion symptoms

Patch Information

The fix adds the missing mgmt_pending_free(cmd) calls in both code paths of set_ssp_complete() and addresses the same issue in set_advertising_complete(). The patches are available through the Linux kernel stable tree:

System administrators should update to kernel versions containing these commits or apply the patches to their current kernel builds.

Workarounds

Disable Bluetooth functionality entirely via rfkill block bluetooth if not operationally required
Schedule periodic reboots for affected systems to clear accumulated memory leaks
Limit Bluetooth pairing operations on critical systems until patching is complete
Use kernel parameters to disable Bluetooth at boot (bluetooth.disable=1) as a temporary measure

bash

# Temporary workaround: Disable Bluetooth to prevent memory leak
rfkill block bluetooth

# Or disable at boot via kernel parameter
# Add to /etc/default/grub GRUB_CMDLINE_LINUX:
# bluetooth.disable=1

# Then update grub configuration
update-grub