CVE-2026-53251: Linux Kernel Bluetooth ISO Reference Count Leak

Technical summary

CVE-2026-53251 is a reference counting leak in the Linux kernel's Bluetooth subsystem, specifically in the ISO connection big synchronization code path. The vulnerability occurs in iso_conn_big_sync() where hci_get_route() is called to retrieve an hci_dev pointer. This function internally calls hci_dev_hold() to increment the device's reference count, but the calling code fails to invoke the corresponding hci_dev_put() to decrement it. The leak occurs regardless of whether the function exits successfully or returns an error condition, resulting in a permanent reference count elevation. This is classified as a resource leak (CWE-772) and carries a CVSS 3.1 score of 5.5 (Medium severity) with local attack vector, low complexity, and low privilege requirements, resulting in availability impact.

Business impact

Organizations running Linux systems with Bluetooth connectivity—particularly IoT devices, wireless headsets, automotive infotainment systems, and embedded Linux deployments—face potential availability degradation. Repeated triggering of the vulnerability can exhaust kernel memory reserved for device reference structures, eventually causing device enumeration failures, Bluetooth subsystem crashes, or forced system resets. While not directly exploitable for data theft or unauthorized access, the availability impact can disrupt critical services, particularly in environments where Bluetooth connectivity is essential for operation.

Affected systems

The Linux kernel is affected across multiple versions. This is a generic reference leak in the Bluetooth ISO subsystem affecting any kernel with the vulnerable iso_conn_big_sync() code path. Verify the exact affected version ranges and applicable kernel flavors (mainline, stable series, distribution kernels) against the official Linux kernel security advisory and your vendor's advisory.

Exploitability

Exploitation requires local access to the system and the ability to trigger Bluetooth ISO connection synchronization. The attack vector is local (AV:L), complexity is low (AC:L), and standard user privileges (PR:L) are sufficient. An attacker with local access could repeatedly invoke the vulnerable code path to gradually deplete reference count structures. However, this is not a sophisticated attack; it primarily affects availability through resource exhaustion rather than enabling privilege escalation or code execution. No known public exploits have been added to the KEV catalog.

Remediation

Apply the kernel patch that adds the missing hci_dev_put() call in the iso_conn_big_sync() error and exit paths. Verify the patch version against the Linux kernel security advisory and your distribution's release notes. Prioritize systems with active Bluetooth connectivity or those serving as Bluetooth relay points. For interim mitigation, restrict local access to unprivileged users and disable Bluetooth if not required for operations.

Patch guidance

Obtain the kernel patch from your Linux distribution's security advisory or the upstream Linux kernel repository. Patches are typically backported to stable kernel series (5.15.x, 6.1.x, 6.6.x, 6.9.x, and later, depending on your vendor). Apply updates according to your standard kernel patching procedures, which typically involves downloading the updated kernel package, installing it, and rebooting. Verify the patch specifically addresses the missing hci_dev_put() in iso_conn_big_sync() before deployment.

Detection guidance

Monitor kernel logs and syslog for Bluetooth subsystem errors, particularly around device reference handling. Use tools like 'kmemleak' on test systems to detect reference count leaks if your kernel is compiled with debugging enabled. Track Bluetooth device enumeration failures or repeated timeouts in dmesg. Network-based detection is limited since this is a kernel-internal leak; focus on endpoint monitoring and system resource anomalies (elevated memory pressure, device allocation failures). Consider regression testing after patching by invoking Bluetooth ISO connections and verifying device reference counts stabilize.

Why prioritize this

This vulnerability rates Medium severity (CVSS 5.5) with local-only access requirements and low complexity. Prioritize patching for systems where Bluetooth is actively used or exposed to untrusted local users, particularly IoT and embedded platforms. It is less critical than remote code execution vulnerabilities but should not be deferred indefinitely, as repeated exploitation in multi-tenant or shared-access scenarios can degrade availability. The lack of KEV catalog inclusion suggests it is not currently weaponized, but the fix is straightforward and low-risk to apply.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) reflects: local attack vector (AV:L, requires system access); low attack complexity (AC:L, no special conditions); low privilege requirements (PR:L, standard user sufficient); no user interaction required (UI:N); no scope change (S:U); no confidentiality or integrity impact (C:N, I:N); but high availability impact (A:H, resource exhaustion over time). The Medium rating acknowledges that while the impact on availability is significant, exploitation requires local access and repeated triggering, and does not enable remote attacks or privilege escalation.

Frequently asked questions