CVE-2026-23151

What it actually does

Memory leak of mgmt_pending_cmd structures and associated parameter data after removal from the pending list in set_ssp_complete() and set_advertising_complete(), caused by missing mgmt_pending_free() calls on both error and success paths following the replacement of mgmt_pending_foreach() with individual command handling.

Why it matters to the business

Gradual exhaustion of kernel memory on Linux systems using Bluetooth, leading to degraded performance, instability, or denial of service over time with repeated SSP or advertising operations; low exploitability and no known active campaigns reduce immediate risk despite widespread kernel exposure.

How an attack unfolds

A local attacker triggers repeated Bluetooth SSP command completions or advertising events to allocate mgmt_pending_cmd structures that are never freed, accumulating leaked memory until system resources are exhausted; no remote vector or named threat actors are associated.

How to fix it

Upgrade the Linux kernel to version 6.12.69 or later; for linux-aws-5.15 on Ubuntu 20.04 LTS apply package version 5.15.0-1047.52~20.04.1 or newer. Reboot after installation to load the corrected kernel.

How to confirm the fix worked

Confirm the running kernel version matches or exceeds the fixed release using uname -r or equivalent package manager queries; review kernel source or changelog for the mgmt_pending_free() additions in set_ssp_complete() and set_advertising_complete().

Typical attack path

1. Obtain local access on a Linux system with Bluetooth enabled
2. Repeatedly issue SSP or advertising-related MGMT commands to trigger completion paths
3. Accumulate unfreed mgmt_pending_cmd allocations over multiple operations
4. Monitor for memory pressure leading to performance degradation or OOM conditions

How to detect it

Review kernel logs for repeated Bluetooth MGMT operations and monitor system memory usage trends; no specific post-exploitation artifacts are present, but correlate with local process activity involving Bluetooth.

What your security team should do

• Prioritize kernel updates on systems with Bluetooth enabled within standard maintenance windows
• Monitor EPSS trend and kernel ecosystem prevalence for any increase in exposure
• Apply updates before the next scheduled reboot cycle on production Bluetooth hosts
• Verify fixed package versions after deployment across all affected distributions