CVE-2026-53364

What it actually does

This is a Linux kernel Bluetooth memory-leak flaw in the hci_le_big_terminate() path. The vulnerable code allocates memory for ISO connection list data and can return early without freeing it when PA sync termination and BIG sync termination are both deemed unnecessary. Repeatedly reaching that logic can consume kernel memory over time, potentially degrading system stability or causing denial of service through memory pressure. The issue is in Bluetooth LE ISO/BIG handling, which is associated with Bluetooth LE Audio broadcast synchronization behavior.

Why it matters to the business

Affected Linux systems with Bluetooth functionality enabled may become unstable or unavailable if the vulnerable path is repeatedly triggered. For workstations, embedded devices, kiosks, IoT, mobile-adjacent Linux platforms, or appliances using Bluetooth LE Audio features, this could cause service disruption, reboots, or device unresponsiveness. Current public exploitation signals are low: EPSS is very low, there is no known CISA KEV listing, no ransomware association, and no public exploit maturity is reported; however, kernel-level denial-of-service flaws should still be patched through normal Linux kernel maintenance because exploitation can affect system availability.

How an attack unfolds

An attacker would need a way to cause the Linux Bluetooth stack to exercise the hci_le_big_terminate() logic under the specific connection-state conditions where neither PA sync termination nor BIG sync termination is selected. Depending on system configuration and Bluetooth exposure, this may involve local access to Bluetooth management interfaces, a privileged process interacting with Bluetooth sockets, or nearby Bluetooth activity that influences LE Audio/BIG synchronization state. Each successful trigger leaks a small kernel allocation instead of releasing it. A single trigger is unlikely to be immediately visible, but repeated triggering can accumulate unreclaimed kernel memory. Over time, the system may experience increasing memory pressure, degraded Bluetooth behavior, OOM-killer activity, service failures, or a crash/reboot.

How to fix it

Update the Linux kernel to a version that includes the upstream fix for the Bluetooth hci_conn memory leak in hci_le_big_terminate(). If consuming kernels from a Linux distribution or appliance vendor, apply the vendor security update when available rather than relying only on upstream version numbers, because kernel fixes are commonly backported. Where immediate patching is not possible, reduce exposure by disabling Bluetooth on systems that do not require it, blocking automatic Bluetooth service startup, restricting access to Bluetooth management interfaces to trusted administrators, and disabling LE Audio/Bluetooth ISO features where supported. For high-availability or embedded systems, prioritize maintenance windows for devices with Bluetooth enabled or exposed in public/proximate areas.

How to confirm the fix worked

Confirm the running kernel is a vendor-fixed build or contains the upstream patch that frees the allocated iso_list_data on all return paths in hci_le_big_terminate(). Validate both the installed kernel package and the active booted kernel, since systems may have patched packages installed but still be running an older kernel until reboot. On source-based or custom kernels, inspect the Bluetooth hci_conn implementation to ensure the early return path releases the allocation. After patching and rebooting, confirm Bluetooth services still function as expected and monitor kernel memory/slab usage during Bluetooth LE Audio or ISO/BIG-related testing to verify allocations are not growing unbounded across repeated termination operations.

Typical attack path

1. Identify a Linux system with Bluetooth enabled and a kernel build containing the vulnerable hci_le_big_terminate() implementation.
2. Establish the ability to influence Bluetooth LE ISO/BIG or related synchronization state, either through local Bluetooth interfaces or proximate Bluetooth interactions, depending on system permissions and exposure.
3. Trigger a termination path where hci_le_big_terminate() allocates ISO list data but determines that neither PA sync termination nor BIG sync termination is required.
4. Repeat the trigger many times so the leaked kernel allocations accumulate.
5. Cause kernel memory pressure that degrades performance, disrupts Bluetooth services, invokes the OOM killer, or makes the system unstable or unavailable.

How to detect it

There are no unique, reliable indicators that prove exploitation of this memory leak after the fact. Investigate possible abuse by correlating kernel memory pressure with Bluetooth activity. Useful sources include kernel logs, system journal logs, OOM-killer events, Bluetooth daemon logs, audit logs for Bluetooth management utilities, endpoint telemetry, and Bluetooth packet captures from tools such as btmon where available. Look for unexplained growth in kernel memory or slab allocations, repeated Bluetooth LE Audio/ISO/BIG synchronization or termination activity, bluetoothd instability, hci device resets, and OOM events occurring after bursts of Bluetooth activity. Because the defect is a leak rather than code execution, forensic evidence may be limited to availability symptoms and Bluetooth event patterns rather than durable files, processes, or network artifacts.

What your security team should do

• Inventory Linux assets with Bluetooth enabled, prioritizing laptops, workstations, kiosks, embedded systems, IoT devices, and appliances deployed in physically accessible areas.
• Patch affected Linux kernels through vendor-supported kernel updates and reboot systems to activate the fixed kernel.
• Temporarily disable Bluetooth on systems where it is not operationally required, especially servers and production appliances.
• Restrict local access to Bluetooth management capabilities and audit users or services that can interact with Bluetooth sockets or management tooling.
• Monitor for abnormal kernel memory growth, OOM-killer events, Bluetooth subsystem instability, and repeated Bluetooth LE/ISO/BIG activity on systems that cannot be patched immediately.
• Track vendor advisories for exact fixed package versions, because the affected product list and fixed versions may vary by distribution due to kernel backporting.