CVE-2026-43022: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-43022 is a resource leak vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the hci_cmd_sync_queue_once() function within hci_sync. The function failed to properly indicate whether a queue item was successfully added, allowing duplicate queue items to accumulate and causing kernel memory exhaustion. It affects Linux kernel versions including 6.1.120, 6.6.51, 6.8.9, 6.9 through before 6.19.12, and release candidates for 7.0 (rc1–rc6). Disclosed on May 1, 2026, it carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime). The hci_cmd_sync_queue_once() function in the Bluetooth HCI synchronization layer did not return a distinct error code when a queue item already existed, so callers could not determine whether their callbacks would be invoked and could not properly release associated resources. This allowed the same queue item to be enqueued multiple times, leading to a resource leak. Exploitation requires local access with low privileges; an attacker can repeatedly issue Bluetooth commands to trigger the leak and exhaust kernel memory. The fix modifies the function to return -EEXIST when a duplicate item is detected, and updates all call sites to handle this condition (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a denial-of-service (DoS) condition on the affected system. A local attacker with low privileges can exhaust kernel memory by repeatedly triggering the resource leak through Bluetooth commands, potentially causing system instability or an unresponsive state. There is no impact on confidentiality or data integrity; the vulnerability is limited to availability and is scoped to systems with Bluetooth functionality enabled (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (GitHub Advisory). The EPSS score is approximately 0.018% (4th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified.

Apply the patched Linux kernel versions that include the fix for hci_cmd_sync_queue_once(). Upstream patches are available at the stable kernel tree commits 0ad2ce230b38cd4b3f6732cc609e270461e626e5 and 2969554bcfccb5c609f6b6cd4a014933f3a66dd0, targeting kernel 6.19.12 and 7.0 (GitHub Advisory). As a temporary workaround, disable or restrict access to Bluetooth interfaces on systems where Bluetooth is not operationally required, and limit local user access to reduce the attack surface (Feedly).