CVE-2026-43022: Linux Kernel Bluetooth HCI Vulnerability

CVE-2026-43022 Overview

CVE-2026-43022 is a resource management vulnerability in the Linux kernel's Bluetooth subsystem. The flaw resides in the hci_cmd_sync_queue_once() function within hci_sync.c. The function did not signal callers when a queue item already existed, so callers could not determine whether registered callbacks would run. This ambiguity led to leaked resources because cleanup paths depended on callback invocation. Maintainers resolved the issue by changing hci_cmd_sync_queue_once() to return -EEXIST when an item already exists, and by updating all callsites to handle that return value.

Critical Impact
Repeated invocations of affected Bluetooth code paths can leak kernel resources, contributing to memory pressure and degraded host stability over time.

Affected Products

Linux kernel (Bluetooth subsystem, hci_sync component)
Distributions shipping the affected kernel revisions prior to the upstream stable fix
Systems with Bluetooth Host Controller Interface (HCI) functionality enabled

Discovery Timeline

2026-05-01 - CVE-2026-43022 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-43022

Vulnerability Analysis

The Linux kernel Bluetooth stack uses hci_cmd_sync_queue_once() to enqueue HCI command work items that should not be queued more than once concurrently. Callers register callbacks that are expected to run as part of the queued work. Before the fix, the function silently returned without notifying the caller when an identical work item was already pending. Callers therefore assumed the callbacks would run and relied on those callbacks to free associated allocations or release references.

When the queue insertion was skipped, the callbacks never executed. Resources tied to the second submission were not released, producing a resource leak in the kernel. Repeated triggering of the affected code paths gradually consumes kernel memory and reference counts.

Root Cause

The root cause is an ambiguous return contract in hci_cmd_sync_queue_once(). The function did not differentiate between successful enqueue and a no-op caused by an existing entry. This is a Memory Leak issue in kernel resource accounting, driven by a missing status signal between producer and consumer code paths.

Attack Vector

A local attacker, or any process able to trigger the affected Bluetooth HCI command flows, can repeatedly invoke the vulnerable paths to accumulate leaked resources. The flaw does not provide direct code execution. Its primary effect is resource exhaustion that can lead to denial of service on long-running systems with Bluetooth enabled. Attack vector classification was not assigned by NVD at publication time.

No verified exploit code is available. The patches are documented in the upstream commits 0ad2ce230b38 and 2969554bcfcc.

Detection Methods for CVE-2026-43022

Indicators of Compromise

Steady growth in kernel slab allocations associated with Bluetooth HCI command structures, observable through /proc/slabinfo.
Increasing reference counts on Bluetooth HCI device objects without corresponding release events in dmesg.
Long-running hosts with active Bluetooth workloads showing unexplained kernel memory consumption.

Detection Strategies

Track kernel version and patch level on all Linux endpoints to identify hosts running pre-patch builds with the Bluetooth subsystem enabled.
Correlate Bluetooth pairing, scanning, or HCI command activity with kernel memory growth trends to surface affected nodes.
Use kernel tracing tools such as ftrace or bpftrace to monitor invocations of hci_cmd_sync_queue_once() and observe non-zero return paths after patching.

Monitoring Recommendations

Alert on Linux hosts where MemAvailable in /proc/meminfo declines steadily without matching userspace allocation.
Monitor dmesg for Bluetooth subsystem warnings and HCI command timeouts.
Inventory Bluetooth-enabled servers, IoT gateways, and workstations and prioritize them for patch verification.

How to Mitigate CVE-2026-43022

Immediate Actions Required

Apply the upstream stable kernel updates that include commits 0ad2ce230b38 and 2969554bcfcc.
Track distribution security advisories from your Linux vendor and schedule kernel upgrades on affected systems.
Reboot patched hosts to load the updated kernel image.

Patch Information

The fix changes hci_cmd_sync_queue_once() to return -EEXIST when a queue item already exists and updates every callsite to handle the new return value. This ensures callers can release resources locally when callbacks will not be invoked. Apply the merged stable kernel revision that contains both referenced commits.

Workarounds

Disable the Bluetooth subsystem on systems that do not require it by unloading the bluetooth and related HCI modules and blacklisting them in /etc/modprobe.d/.
Restrict access to Bluetooth management interfaces by limiting CAP_NET_ADMIN and membership in groups that can issue HCI commands.
Schedule periodic reboots on hosts that cannot be patched immediately to clear accumulated leaked resources.

bash

# Configuration example: disable Bluetooth modules until patched
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb'     | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo systemctl disable --now bluetooth.service
sudo modprobe -r btusb bluetooth || true