CVE-2026-43021: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-43021 is a memory leak vulnerability in the Linux kernel's Bluetooth HCI synchronization subsystem. Specifically, when hci_cmd_sync_queue_once() returns an error, the destroy callback is not invoked, causing references and memory to leak. The vulnerability affects Linux kernel versions from 6.19 up to (but not including) 6.19.12, as well as 7.0 release candidates (rc1 through rc6). It was published on May 1, 2026, with patches released by May 8, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory).

The root cause is classified under CWE-772 (Missing Release of Resource after Effective Lifetime) and CWE-401 (Missing Release of Memory after Effective Lifetime), reflecting improper resource cleanup in the Bluetooth HCI command synchronization path. When hci_cmd_sync_queue_once() fails and returns an error code, the associated destroy callback is never called, leaving allocated memory and object references unreleased. Exploitation requires local access with low privileges, as an attacker must be able to trigger Bluetooth HCI command synchronization failures on the affected system. No public proof-of-concept exploit code is known to exist (Github Advisory).

Successful exploitation causes memory and reference leaks that accumulate over time within the kernel's Bluetooth HCI subsystem. A local low-privileged user can repeatedly trigger these failures, gradually exhausting system memory resources and degrading system performance. In severe cases, sustained exploitation could render the system unresponsive, constituting a denial-of-service condition. There is no impact on confidentiality or data integrity (Github Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (4th percentile), indicating a very low probability of exploitation in the near term. Exploitation is limited to local attackers with low-privilege access, further reducing the practical risk (Github Advisory).

Update the Linux kernel to version 6.19.12 or later, which includes the fix for this vulnerability. For systems running 7.0 release candidates, the fix is included in the 7.0 stable release. Specific patches are available directly from the kernel stable tree at git.kernel.org. As an interim measure, restrict local system access to trusted users and monitor system memory usage for signs of gradual resource exhaustion in the Bluetooth subsystem (Github Advisory).