CVE-2026-53364: Linux Kernel Bluetooth Memory Leak Flaw

CVE-2026-53364 Overview

CVE-2026-53364 is a memory leak vulnerability in the Linux kernel Bluetooth subsystem. The flaw resides in the hci_le_big_terminate() function within hci_conn.c, which handles Broadcast Isochronous Group (BIG) termination for LE Audio connections. The function allocates an iso_list_data structure using kzalloc but returns without freeing it when neither the pa_sync_term nor big_sync_term flags are set. Repeated invocation of this early-return path causes progressive kernel memory exhaustion on systems using Bluetooth LE Audio isochronous streams.

Critical Impact
Repeated triggering of the leak path in hci_le_big_terminate() gradually depletes kernel memory, potentially degrading system stability on hosts that manage Bluetooth Periodic Advertising (PA) and BIG synchronization.

Affected Products

Linux kernel versions containing the refactored hci_le_big_terminate() implementation that accepts struct hci_conn
Bluetooth subsystem (net/bluetooth/hci_conn.c)
Distributions shipping affected mainline and stable kernel branches

Discovery Timeline

2026-07-13 - CVE-2026-53364 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-53364

Vulnerability Analysis

The defect lies in the control flow of hci_le_big_terminate(), a function responsible for terminating Periodic Advertising synchronization and BIG synchronization for Bluetooth LE Audio broadcast reception. The function first allocates an iso_list_data structure via kzalloc_obj to carry state used by the terminate logic.

After allocation, the function evaluates the current PA and BIG synchronization state of the supplied struct hci_conn. When neither the pa_sync_term nor big_sync_term flags are set, the function returns 0 immediately. This return path never releases the previously allocated iso_list_data, producing a memory leak on every invocation that reaches it.

Root Cause

The leak was introduced when hci_le_big_terminate() was refactored from accepting raw u8 parameters to accepting struct hci_conn. The refactor added PA/BIG flag evaluation logic and a new early-return branch, but the corresponding kfree() cleanup was not added on that branch. An existing kfree() covering the hci_cmd_sync_queue failure case does not protect the new path, leaving allocated memory orphaned [CWE-401].

Attack Vector

Exploitation requires triggering repeated calls into the Bluetooth LE audio termination path with a hci_conn whose PA and BIG sync flags remain clear. This condition is typically reached during normal broadcast source discovery, disconnection, or state-machine churn on hosts using LE Audio. Because the affected function runs in kernel context, memory pressure accumulates in unreclaimable kernel slabs rather than user-space allocations.

The vulnerability mechanism is a missing kfree(iso_list_data) on the early-return branch. No verified exploit code is publicly available. Refer to the upstream commit references for the precise patch and code delta.

Detection Methods for CVE-2026-53364

Indicators of Compromise

Steady growth in kernel slab consumption reported by /proc/slabinfo for allocations backing iso_list_data without a corresponding increase in active Bluetooth ISO connections
Unexplained increase in Slab and SUnreclaim values in /proc/meminfo on hosts using Bluetooth LE Audio
Kernel log entries associated with hci_le_big_terminate and repeated PA/BIG termination attempts

Detection Strategies

Compare running kernel versions and Bluetooth subsystem commit identifiers against the fixed commits a59d4f4217e6, bfa9d28960ed, and e6b78019664d
Deploy kmemleak on test kernels to confirm the leak signature on the hci_le_big_terminate() allocation path
Correlate long-running host memory growth with Bluetooth workload patterns using OS telemetry

Monitoring Recommendations

Track kernel memory metrics over time on endpoints and IoT gateways that use Bluetooth LE Audio broadcast reception
Alert on sustained SUnreclaim growth that cannot be explained by workload changes
Audit installed kernel package versions across the fleet and flag hosts running unpatched stable branches

How to Mitigate CVE-2026-53364

Immediate Actions Required

Apply the upstream stable kernel updates that include the fix for hci_le_big_terminate()
On systems that do not require Bluetooth LE Audio broadcast reception, unload or disable the Bluetooth stack to eliminate the code path
Reboot hosts after patching to release memory already leaked by the vulnerable code

Patch Information

The fix restructures hci_le_big_terminate() so that the iso_list_data allocation is released on the early-return branch when neither pa_sync_term nor big_sync_term is set. Patch commits are available upstream:

Distribution maintainers should backport these commits to supported stable branches and rebuild affected packages.

Workarounds

Blacklist the bluetooth kernel module on servers and appliances that do not require Bluetooth functionality
Disable Bluetooth LE Audio broadcast sink use cases in userspace services such as bluetoothd until the patched kernel is deployed
Schedule periodic reboots on unpatched hosts that must retain Bluetooth support to reclaim leaked kernel memory

bash

# Verify the running kernel version and Bluetooth module status
uname -r
lsmod | grep -E '^bluetooth|^btusb'

# Temporarily unload Bluetooth modules on hosts that do not need them
sudo systemctl stop bluetooth.service
sudo modprobe -r btusb bluetooth

# Persistently disable the Bluetooth module
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf