CVE-2026-43069

This vulnerability is a resource leak in the Linux kernel's Bluetooth HCI LL driver (hci_ll.c). The download_firmware() function successfully requests a firmware file via request_firmware(), but if the firmware content is invalid (zero length or no data), the function returns without releasing the firmware buffer, causing a memory leak. This was detected by the static analysis tool Smatch [1].

To exploit this, an attacker must be able to trigger firmware loading on a Bluetooth HCI UART (LL) device, typically during device initialization. This could be achieved by providing a malformed firmware file or by having a compromised Bluetooth device. No authentication is required, but local access or physical proximity may be necessary.

The impact is a memory leak that, if triggered repeatedly, can lead to resource exhaustion and denial of service (DoS). The vulnerability does not allow code execution or privilege escalation.

The issue has been fixed in the Linux kernel stable tree. Multiple commits addressing this bug have been applied to various stable branches [1][2][3][4]. Users should update their kernel to include these fixes. No workarounds other than patching are known.