Memory Leak Vulnerability in Linux Kernel Bluetooth Module

CVE-2026-53364

What is CVE-2026-53364?

In the Linux Kernel's Bluetooth module, the hci_le_big_terminate function contains a flaw that can lead to a memory leak. When specific flags are not set during the evaluation of the PA and BIG sync connection state, the function allocates memory for iso_list_data but fails to free it before exiting. This oversight was introduced during a recent refactoring process. If the memory is not properly freed, it could result in performance degradation or system instability over time as allocated memory accumulates without release.

References