CVE-2026-43069

medium

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_ll: Fix firmware leak on error path Smatch reports: drivers/bluetooth/hci…

Vendor / product: Linux — linux kernel

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_ll: Fix firmware leak on error path Smatch reports: drivers/bluetooth/hci_ll.c:587 download_firmware() warn: 'fw' from request_firmware() not released on lines: 544. In download_firmware(), if request_firmware() succeeds but the returned firmware content is invalid (no data or zero size), the function returns without releasing the firmware, resulting in a resource leak. Fix this by calling release_firmware() before returning when request_firmware() succeeded but the firmware content is invalid.

CVSS

5.5

5.5 (CVSS v3.1)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-05-05 16:16

Modified: 2026-11-11 21:10

NVD status: Analyzed

Last synced 5 hours ago

Verified against the source API 2026-11-11 21:11 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

linux / linux_kernel ≥4.12 <5.10.253, ≥5.11 <5.15.203, ≥5.16 <6.1.168, ≥6.2 <6.6.131, ≥6.7 <6.12.80, ≥6.13 <6.18.21

Weakness classification (CWE)

CWE-401

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Patch / mitigation: https://git.kernel.org/stable/c/28904375d54b436a757641fb0331537778c0de5a

Patch / mitigation: https://git.kernel.org/stable/c/31148a7be723aa9f2e8fbd62424825ab8d577973

Patch / mitigation: https://git.kernel.org/stable/c/5213ef54528dd1ac79b846e30d8f72ce092794aa

Patch / mitigation: https://git.kernel.org/stable/c/95e8601af227b2b4390eecf8db6abdb9f6a91f17

Patch / mitigation: https://git.kernel.org/stable/c/9ecbfd93cd6de6c78cb7fd51fe079e36c7ff074b

Patch / mitigation: https://git.kernel.org/stable/c/a7803df606a7d22e896b030f619e1d9d20ae0c6b

Patch / mitigation: https://git.kernel.org/stable/c/b2dfbf1b5ff192cefd49574b951a4af9ddd32213

Patch / mitigation: https://git.kernel.org/stable/c/e6d95488c8c964d1df0d3e1db44c958706311e86

References

https://git.kernel.org/stable/c/28904375d54b436a757641fb0331537778c0de5a 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/31148a7be723aa9f2e8fbd62424825ab8d577973 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5213ef54528dd1ac79b846e30d8f72ce092794aa 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/95e8601af227b2b4390eecf8db6abdb9f6a91f17 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9ecbfd93cd6de6c78cb7fd51fe079e36c7ff074b 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a7803df606a7d22e896b030f619e1d9d20ae0c6b 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b2dfbf1b5ff192cefd49574b951a4af9ddd32213 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/e6d95488c8c964d1df0d3e1db44c958706311e86 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Data sources

NVD CVE API 2.0 — fetched 2026-11-11 21:11 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-43069

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs