CVE-2026-43069: Linux Kernel Bluetooth Firmware Leak Flaw

CVE-2026-43069 Overview

CVE-2026-43069 is a memory leak vulnerability in the Linux kernel Bluetooth hci_ll driver. The flaw resides in the download_firmware() function within drivers/bluetooth/hci_ll.c. When request_firmware() succeeds but returns invalid firmware content (no data or zero size), the function exits without calling release_firmware(). This leaves allocated firmware memory unreleased on the error path. Static analysis from the Smatch tool flagged the unreleased resource at line 544 of the affected source file. The Linux kernel maintainers have resolved the issue across multiple stable branches.

Critical Impact
Repeated invocation of the affected firmware loading path can exhaust kernel memory, leading to resource starvation on systems using Texas Instruments Bluetooth controllers with the hci_ll driver.

Affected Products

Linux kernel Bluetooth subsystem (hci_ll driver)
drivers/bluetooth/hci_ll.c in mainline and stable kernel branches
Devices using Texas Instruments Bluetooth controllers via UART transport

Discovery Timeline

2026-05-05 - CVE-2026-43069 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43069

Vulnerability Analysis

The vulnerability is a kernel memory leak [CWE-401] in the Linux Bluetooth hci_ll host controller interface driver. The download_firmware() function loads firmware blobs into Texas Instruments Bluetooth chips during device initialization. The function calls request_firmware() to obtain the firmware image from userspace, then validates the returned buffer before parsing it. When validation fails because the buffer pointer is null or the size is zero, the function returns immediately. The corresponding release_firmware() call is skipped, and the kernel-allocated firmware structure remains in memory indefinitely. Each failed firmware load on the affected code path increases kernel memory consumption.

Root Cause

The root cause is missing cleanup on an error return path. The validation check after request_firmware() did not include a release call before returning. Resource acquisition succeeded, but the corresponding release was tied only to the success path of the function. This pattern violates the standard Linux kernel resource management convention where every successful allocation must have a matching release on all exit paths.

Attack Vector

Local attack scenarios are limited because firmware loading is typically triggered during device probe or controller reset. An attacker with the ability to repeatedly trigger Bluetooth controller initialization, combined with the ability to influence the firmware image returned by userspace, could amplify the leak. Practical exploitation requires elevated privileges and is constrained by the rarity of invalid firmware files on production systems. The primary impact is reliability degradation rather than direct compromise.

No public exploit code is available. The fix is documented across the kernel.org stable commits including 28904375, 31148a7b, 5213ef54, 95e8601a, 9ecbfd93, a7803df6, b2dfbf1b, and e6d95488. See the kernel commit a7803df6 for the upstream fix.

Detection Methods for CVE-2026-43069

Indicators of Compromise

Kernel log entries from the hci_ll driver indicating firmware load failures or invalid firmware content warnings
Steady growth in kernel slab allocations associated with firmware loading without corresponding frees
Repeated Bluetooth controller resets or initialization failures on systems using TI Bluetooth UART chips

Detection Strategies

Audit running kernel versions against the patched stable releases referenced in the kernel.org commits
Monitor /proc/slabinfo and /sys/kernel/debug/kmemleak on test systems for accumulating firmware-related allocations
Review dmesg output for hci_ll warnings and correlate with subsequent memory pressure events

Monitoring Recommendations

Track kernel memory utilization on Bluetooth-enabled embedded and IoT systems for unexplained growth
Alert on repeated Bluetooth firmware download failures, which indicate the vulnerable code path is being exercised
Maintain a software bill of materials for kernel versions deployed across endpoints to identify systems running unpatched builds

How to Mitigate CVE-2026-43069

Immediate Actions Required

Update affected systems to a Linux kernel build that includes the hci_ll firmware leak fix from the referenced stable commits
Inventory devices that use the hci_ll driver, particularly Texas Instruments Bluetooth UART hardware in embedded and mobile platforms
Validate that firmware files served to the kernel are well-formed and non-empty to avoid triggering the vulnerable error path

Patch Information

The fix adds a release_firmware() call before the early return when request_firmware() succeeds but returns invalid content. The patch is available in the upstream Linux kernel and has been backported to multiple stable trees. Reference commits include 28904375, 31148a7b, 5213ef54, 95e8601a, 9ecbfd93, a7803df6, b2dfbf1b, and e6d95488.

Workarounds

Unload the hci_ll kernel module on systems where Texas Instruments UART Bluetooth is not required
Restrict the firmware search path to a controlled directory containing only validated firmware blobs
Reboot affected systems periodically until patches are applied to reclaim leaked kernel memory

bash

# Verify whether the hci_ll module is loaded and unload if unused
lsmod | grep hci_ll
sudo modprobe -r hci_ll

# Confirm running kernel version against patched stable releases
uname -r