Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-43069

Bluetooth: hci_ll: Fix firmware leak on error path

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_ll: Fix firmware leak on error path Smatch reports: drivers/bluetooth/hci_ll.c:587 download_firmware() warn: 'fw' from request_firmware() not released on lines: 544. In download_firmware(), if request_firmware() succeeds but the returned firmware content is invalid (no data or zero size), the function returns without releasing the firmware, resulting in a resource leak. Fix this by calling release_firmware() before returning when request_firmware() succeeded but the firmware content is invalid.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 371805522f870986144fcd88727a47858e364a2c to < 95e8601af227b2b4390eecf8db6abdb9f6a91f17affected
  • 371805522f870986144fcd88727a47858e364a2c to < e6d95488c8c964d1df0d3e1db44c958706311e86affected
  • 371805522f870986144fcd88727a47858e364a2c to < b2dfbf1b5ff192cefd49574b951a4af9ddd32213affected
  • 371805522f870986144fcd88727a47858e364a2c to < 28904375d54b436a757641fb0331537778c0de5aaffected
  • 371805522f870986144fcd88727a47858e364a2c to < 5213ef54528dd1ac79b846e30d8f72ce092794aaaffected
  • 371805522f870986144fcd88727a47858e364a2c to < 9ecbfd93cd6de6c78cb7fd51fe079e36c7ff074baffected
  • 371805522f870986144fcd88727a47858e364a2c to < a7803df606a7d22e896b030f619e1d9d20ae0c6baffected
  • 371805522f870986144fcd88727a47858e364a2c to < 31148a7be723aa9f2e8fbd62424825ab8d577973affected

Linux Linux

Default version status: affected

  • 4.12affected
  • 0 to < 4.12unaffected
  • 5.10.253 to ≤ 5.10.*unaffected
  • 5.15.203 to ≤ 5.15.*unaffected
  • 6.1.168 to ≤ 6.1.*unaffected
  • 6.6.131 to ≤ 6.6.*unaffected
  • 6.12.80 to ≤ 6.12.*unaffected
  • 6.18.21 to ≤ 6.18.*unaffected
  • 6.19.11 to ≤ 6.19.*unaffected
  • 7.0 to ≤ *unaffected

References