GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23151 (GCVE-0-2026-23151)

Vulnerability from cvelistv5 – Published: 2026-02-14 16:01 – Updated: 2026-05-23 16:04
VLAI
Title
Bluetooth: MGMT: Fix memory leak in set_ssp_complete
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in set_ssp_complete Fix memory leak in set_ssp_complete() where mgmt_pending_cmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") replaced mgmt_pending_foreach() calls with individual command handling but missed adding mgmt_pending_free() calls in both error and success paths of set_ssp_complete(). Other completion functions like set_le_complete() were fixed correctly in the same commit. This causes a memory leak of the mgmt_pending_cmd structure and its associated parameter data for each SSP command that completes. Add the missing mgmt_pending_free(cmd) calls in both code paths to fix the memory leak. Also fix the same issue in set_advertising_complete().
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a , < d7e42dc47beb48851bc0008c1e1b79126de9d975 (git)
Affected: d71b98f253b079cbadc83266383f26fe7e9e103b , < 1850a558d116d7e3e2ef36d06a56f59b640cc214 (git)
Affected: 302a1f674c00dd5581ab8e493ef44767c5101aab , < 3b6318505378828ee415d6ef678db6a74c077504 (git)
Affected: 302a1f674c00dd5581ab8e493ef44767c5101aab , < 1b9c17fd0a7fdcbe69ec5d6fe8e50bc5ed7f01f2 (git)
Affected: 87a1f16f07c6c43771754075e08f45b41d237421 (git)
Affected: 6.12.59 , < 6.12.69 (semver)
Affected: 6.16.10 , < 6.17 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.12.69 , ≤ 6.12.* (semver)
Unaffected: 6.18.9 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d7e42dc47beb48851bc0008c1e1b79126de9d975",
              "status": "affected",
              "version": "0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a",
              "versionType": "git"
            },
            {
              "lessThan": "1850a558d116d7e3e2ef36d06a56f59b640cc214",
              "status": "affected",
              "version": "d71b98f253b079cbadc83266383f26fe7e9e103b",
              "versionType": "git"
            },
            {
              "lessThan": "3b6318505378828ee415d6ef678db6a74c077504",
              "status": "affected",
              "version": "302a1f674c00dd5581ab8e493ef44767c5101aab",
              "versionType": "git"
            },
            {
              "lessThan": "1b9c17fd0a7fdcbe69ec5d6fe8e50bc5ed7f01f2",
              "status": "affected",
              "version": "302a1f674c00dd5581ab8e493ef44767c5101aab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "87a1f16f07c6c43771754075e08f45b41d237421",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.69",
              "status": "affected",
              "version": "6.12.59",
              "versionType": "semver"
            },
            {
              "lessThan": "6.17",
              "status": "affected",
              "version": "6.16.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.69",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.69",
                  "versionStartIncluding": "6.12.59",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.9",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.16.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix memory leak in set_ssp_complete\n\nFix memory leak in set_ssp_complete() where mgmt_pending_cmd structures\nare not freed after being removed from the pending list.\n\nCommit 302a1f674c00 (\"Bluetooth: MGMT: Fix possible UAFs\") replaced\nmgmt_pending_foreach() calls with individual command handling but missed\nadding mgmt_pending_free() calls in both error and success paths of\nset_ssp_complete(). Other completion functions like set_le_complete()\nwere fixed correctly in the same commit.\n\nThis causes a memory leak of the mgmt_pending_cmd structure and its\nassociated parameter data for each SSP command that completes.\n\nAdd the missing mgmt_pending_free(cmd) calls in both code paths to fix\nthe memory leak. Also fix the same issue in set_advertising_complete()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:04:00.411Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d7e42dc47beb48851bc0008c1e1b79126de9d975"
        },
        {
          "url": "https://git.kernel.org/stable/c/1850a558d116d7e3e2ef36d06a56f59b640cc214"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b6318505378828ee415d6ef678db6a74c077504"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b9c17fd0a7fdcbe69ec5d6fe8e50bc5ed7f01f2"
        }
      ],
      "title": "Bluetooth: MGMT: Fix memory leak in set_ssp_complete",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23151",
    "datePublished": "2026-02-14T16:01:19.663Z",
    "dateReserved": "2026-01-13T15:37:45.976Z",
    "dateUpdated": "2026-05-23T16:04:00.411Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23151",
      "date": "2026-09-16",
      "epss": "0.00119",
      "percentile": "0.01976"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23151\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-14T16:15:55.233\",\"lastModified\":\"2026-06-17T10:20:59.660\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: MGMT: Fix memory leak in set_ssp_complete\\n\\nFix memory leak in set_ssp_complete() where mgmt_pending_cmd structures\\nare not freed after being removed from the pending list.\\n\\nCommit 302a1f674c00 (\\\"Bluetooth: MGMT: Fix possible UAFs\\\") replaced\\nmgmt_pending_foreach() calls with individual command handling but missed\\nadding mgmt_pending_free() calls in both error and success paths of\\nset_ssp_complete(). Other completion functions like set_le_complete()\\nwere fixed correctly in the same commit.\\n\\nThis causes a memory leak of the mgmt_pending_cmd structure and its\\nassociated parameter data for each SSP command that completes.\\n\\nAdd the missing mgmt_pending_free(cmd) calls in both code paths to fix\\nthe memory leak. Also fix the same issue in set_advertising_complete().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nBluetooth: MGMT: Correcci\u00f3n de fuga de memoria en set_ssp_complete\\n\\nCorrige la fuga de memoria en set_ssp_complete() donde las estructuras mgmt_pending_cmd no son liberadas despu\u00e9s de ser eliminadas de la lista de pendientes.\\n\\nEl commit 302a1f674c00 (\u0027Bluetooth: MGMT: Corrige posibles UAFs\u0027) reemplaz\u00f3 las llamadas a mgmt_pending_foreach() con el manejo individual de comandos, pero omiti\u00f3 a\u00f1adir llamadas a mgmt_pending_free() tanto en las rutas de error como de \u00e9xito de set_ssp_complete(). Otras funciones de completado como set_le_complete() fueron corregidas correctamente en el mismo commit.\\n\\nEsto causa una fuga de memoria de la estructura mgmt_pending_cmd y sus datos de par\u00e1metros asociados para cada comando SSP que se completa.\\n\\nA\u00f1ade las llamadas faltantes a mgmt_pending_free(cmd) en ambas rutas de c\u00f3digo para corregir la fuga de memoria. Tambi\u00e9n corrige el mismo problema en set_advertising_complete().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/mgmt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a\",\"lessThan\":\"d7e42dc47beb48851bc0008c1e1b79126de9d975\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d71b98f253b079cbadc83266383f26fe7e9e103b\",\"lessThan\":\"1850a558d116d7e3e2ef36d06a56f59b640cc214\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"302a1f674c00dd5581ab8e493ef44767c5101aab\",\"lessThan\":\"3b6318505378828ee415d6ef678db6a74c077504\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"302a1f674c00dd5581ab8e493ef44767c5101aab\",\"lessThan\":\"1b9c17fd0a7fdcbe69ec5d6fe8e50bc5ed7f01f2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"87a1f16f07c6c43771754075e08f45b41d237421\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.59\",\"lessThan\":\"6.12.69\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.16.10\",\"lessThan\":\"6.17\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/mgmt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.69\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.9\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.59\",\"versionEndExcluding\":\"6.12.69\",\"matchCriteriaId\":\"A53284ED-D418-4297-9CC1-383716BAE112\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16.10\",\"versionEndExcluding\":\"6.17\",\"matchCriteriaId\":\"1C91278E-7FC3-4EFB-AE2C-E82D42F4D3AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.17.1\",\"versionEndExcluding\":\"6.18.9\",\"matchCriteriaId\":\"8A25DDAF-7C27-4AFF-A350-9BD6DD15CBE1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1850a558d116d7e3e2ef36d06a56f59b640cc214\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1b9c17fd0a7fdcbe69ec5d6fe8e50bc5ed7f01f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3b6318505378828ee415d6ef678db6a74c077504\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d7e42dc47beb48851bc0008c1e1b79126de9d975\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T11:37:31+00:00",
      "cve": "CVE-2026-23151",
      "id": "CVE-2026-23151",
      "initial_release_date": "2026-02-14T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Memory leak in Bluetooth MGMT can lead to denial of service",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23151.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-24T02:39:12Z",
      "cve": "CVE-2026-23151",
      "id": "CVE-2026-23151",
      "initial_release_date": "2026-02-16T00:26:09Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "442",
      "product_status:known_not_affected": "161",
      "product_status:recommended": "295",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23151",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23151.json",
      "version": "27"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.