CVE-2026-23151: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23151 is a memory leak vulnerability in the Linux kernel's Bluetooth MGMT subsystem, specifically within the set_ssp_complete() and set_advertising_complete() functions. The flaw was introduced when commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") replaced mgmt_pending_foreach() calls with individual command handling but omitted the necessary mgmt_pending_free() calls in both error and success paths. Affected Linux kernel versions include 6.12.59–6.12.68, 6.16.10 through 6.16.x, 6.17 and 6.17.1–6.18.8, and 6.19 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). When an SSP (Secure Simple Pairing) command completes, the mgmt_pending_cmd structure and its associated parameter data are removed from the pending list but never freed, causing a persistent memory leak per completed command. The vulnerability requires local access with low privileges and no user interaction to trigger, as an attacker simply needs to repeatedly issue Bluetooth SSP or advertising commands through the MGMT interface. The fix involves adding mgmt_pending_free(cmd) calls in both the error and success code paths of the affected functions (Feedly, Kernel Patch 1).

Successful exploitation causes progressive memory exhaustion in the kernel's Bluetooth MGMT subsystem. A local attacker with low privileges can repeatedly trigger the leak by issuing SSP or advertising commands, potentially crashing the Bluetooth subsystem or the entire kernel over time, resulting in a denial of service. There is no confidentiality or integrity impact; the vulnerability is limited to availability (CVSS availability impact: High) (Feedly).

Apply the upstream Linux kernel patches that add the missing mgmt_pending_free() calls in set_ssp_complete() and set_advertising_complete(). Fixed versions include Linux kernel 6.12.69+, 6.16.x (after 6.16.10), 6.18.9+, and any stable release beyond the 6.19 RC series. Multiple fix commits are available in the Linux kernel stable tree (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3). As a temporary workaround where patching is not immediately possible, restrict local access to Bluetooth MGMT interfaces and limit Bluetooth operations to trusted users and applications only (Feedly).

Vendor advisories have been issued for Oracle Linux (ELSA-2026-50160, ELSA-2026-50232) and Ubuntu (USN-8393-1), reflecting standard downstream kernel update processes (Oracle Advisory, Ubuntu Advisory). The vulnerability has been picked up by security scanning platforms including Nessus and Qualys. No notable researcher commentary or significant social media discussion has been observed beyond routine vulnerability tracking.