CVE-2026-43022 Linux CVE debrief

Who should care

Linux kernel maintainers, administrators, and users of affected kernel versions should assess exposure and apply patches or updates as needed to prevent potential resource leaks. This involves verifying Linux kernel versions, comparing against affected versions, and monitoring system logs for potential exploitation attempts. Prioritization is crucial for Linux kernel maintainers and users of affected versions to prevent potential resource leaks.

Why it matters

CVE-2026-43022 is a medium-severity vulnerability in the Linux kernel that requires verification of exposure and prompt patching to prevent potential resource leaks. Linux kernel maintainers, administrators, and users of affected versions should prioritize patching.

• Verify Linux kernel versions and apply patches to prevent potential resource leaks
• Monitor system logs for exploitation attempts targeting this vulnerability
• Update inventory management to track affected kernel versions

Technical summary

The Linux kernel was updated to change the behavior of hci_cmd_sync_queue_once() to return -EEXIST if a queue item already exists. This helps callers avoid potential resource leaks by indicating whether a queue item was added. The change affects multiple kernel versions, including 6.9 through 6.19.12 and several specific versions, such as 6.1.120, 6.6.51, 6.8.9, and 7.0 rc1 through rc6. This update requires verification of exposure and prompt patching to prevent potential resource leaks. Linux kernel maintainers, administrators, and users of affected versions should prioritize patching.

Defensive priority

Apply patch or update to affected Linux kernel versions

Recommended defensive actions

• Review Linux kernel versions in use and compare against affected versions
• Apply patches or updates provided by Linux kernel maintainers
• Monitor system logs for potential exploitation attempts
• Verify Linux kernel versions and apply patches to prevent potential resource leaks
• Update inventory management to track affected kernel versions
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and affected kernel versions. Patches are available for the issue. Linux kernel maintainers and users should verify exposure and apply patches or updates as needed to prevent potential resource leaks. This involves reviewing Linux kernel versions in use, comparing against affected versions, and monitoring system logs for potential exploitation attempts. The change affects multiple kernel versions, including 6.9 through 6.19.12 and several specific versions. Evidence is

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.